Fix payment review round 3: saved-card idempotency, stale-pending sweep, webhook fail-closed

R1/R4: saved_card branch in CreateTerminalPayment now mirrors CreateTipPayment
- advisory lock (crussell:payment:<bookingID>) serializes concurrent double-clicks
- deterministic key bookingID-sc-type-amount-cardID (<=45 chars) so a lost-response
  retry derives the same key and dedups instead of double-charging
- idempotency switch inside the lock: completed -> dedup, pending -> reuse with
  pence amount-guard, failed -> clean 409
- success response includes card_brand/card_last4 (frontend already reads them)

R2: add 'failed' case to all four retry switches (tip, booking, gift card, till)
- a swept/definitively-rejected record returns 409 instead of 500-ing on the
  idempotency_key UNIQUE constraint

R3: extend SweepStalePendingPayments to till_sales card rows
- sweeps pending till_sales (online_square/in_person_card) past Square's ~24h
  key retention, closing the double-charge window for till sales
- swept rows logged with the same CRITICAL manual-reconciliation marker as the
  refund sweep

Webhook fail-closed: reject 503 when SQUARE_WEBHOOK_SIGNATURE_KEY unset, 403 on
bad signature (was: skip verification in dev)

Refund status resolution: refunds now resolve by Square status
(COMPLETED/PENDING/FAILED/REJECTED) instead of assuming completed; real error
codes (REFUND_AMOUNT_INVALID, PAYMENT_NOT_REFUNDABLE, REFUND_ALREADY_PENDING)
added to the definitive/processed classification

HTTP client: CreateCard key truncated to <=45 chars, device_options always sent
(env SQUARE_TERMINAL_DEVICE_ID fallback), processing_fee reads amount_money,
ListCards cursor loop, refund keys hashed to <=45 chars

Other fixes: payment/till/gift-card advisory-lock + FOR UPDATE asymmetries,
GetPaymentByID NULL scans, loyalty redemption lock, card upsert on conflict,
mock ccof: prefix parity, IsValidSquareCheckoutID for real Square IDs,
isAdminRequest defense-in-depth on all 6 admin payment handlers, webhook
signature docs, M8/L5 debug markers removed

Docs: README/FC/TM/Overview updated (22 jobs, 20 CRITICAL sites, 23-section
GDPR export, sweep jobs, webhook fail-closed); P11 plan marks remaining items
(sandbox smoke test, M-8 customer_id, saved-card key dedup trade-off) as
deferred with rationale; gap backlog pruned of completed items

frontend/src/lib/components/payments/PaymentModal.svelte

@@ -67,9 +67,10 @@
 	let savedCardList = $state<
 		Array<{
 			id: string;
-			card_brand: string;
-			card_last4: string;
-			card_expiry: string;
+			brand: string;
+			last_4: string;
+			exp_month: number;
+			exp_year: number;
 			cardholder_name?: string;
 		}>
 	>([]);
@@ -559,13 +560,16 @@
 		}
 	}
 
-	// Saved cards
+	// Saved cards — fields match the backend SavedCard shape (brand, last_4,
+	// exp_month, exp_year), not the old card_brand/card_last4/card_expiry names
+	// which rendered blank.
 	let savedCards = $state<
 		Array<{
 			id: string;
-			card_brand: string;
-			card_last4: string;
-			card_expiry: string;
+			brand: string;
+			last_4: string;
+			exp_month: number;
+			exp_year: number;
 			cardholder_name?: string;
 		}>
 	>([]);
@@ -1183,11 +1187,11 @@
 											<rect x="1" y="4" width="22" height="16" rx="2" ry="2" />
 											<line x1="1" y1="10" x2="23" y2="10" />
 										</svg>
-										<span class="font-medium text-gray-900"
-											>{card.card_brand} ••••{card.card_last4}</span
-										>
+										<span class="font-medium text-gray-900">{card.brand} ••••{card.last_4}</span>
 									</div>
-									<span class="text-xs text-gray-500">{card.card_expiry}</span>
+									<span class="text-xs text-gray-500"
+										>{String(card.exp_month).padStart(2, '0')}/{card.exp_year}</span
+									>
 								</div>
 								{#if card.cardholder_name}
 									<div class="mt-1 text-xs text-gray-500">{card.cardholder_name}</div>

frontend/src/lib/square/square.ts

@@ -22,12 +22,18 @@ export function getSquareConfig(): SquareConfig | null {
 	return { appId: APP_ID, locationId: LOCATION_ID };
 }
 
+// Pinned SDK version: Square.js is loaded from the /v1/ path, which is
+// Square's stable major version. Square does not publish SRI hashes, so no
+// integrity attribute can be set — the /v1/ version pin is the supply-chain
+// control (S-3). Monitor Square's release notes before major bumps.
+const SQUARE_SDK_VERSION = 'v1';
+
 function sdkUrl(): string {
 	const env = (import.meta.env.VITE_SQUARE_ENVIRONMENT as string | undefined) ?? '';
 	const isSandbox = env === 'sandbox' || (APP_ID !== '' && APP_ID.startsWith('sandbox-'));
 	return isSandbox
-		? 'https://sandbox.web.squarecdn.com/v1/square.js'
-		: 'https://web.squarecdn.com/v1/square.js';
+		? `https://sandbox.web.squarecdn.com/${SQUARE_SDK_VERSION}/square.js`
+		: `https://web.squarecdn.com/${SQUARE_SDK_VERSION}/square.js`;
 }
 
 let sdkPromise: Promise<unknown> | null = null;