fix: payments review rounds — money-safety, GDPR, security, gift-card cancel, modal stacking

Money-safety:
- Deterministic till idempotency fallback (Square-charging only); cash/on_the_house keep unique keys; £250 till gift-card cap; 45-char key validation
- Gift-card admin caps £250/tx + £5,000/day; user buy £500/day; BuyGiftCard allowlist unchanged
- CancelGiftCard: CCR 2013 14-day right with partial-spend refund of the unspent balance (spend verified via payments.gift_card_id); atomic vs redeem/transfer; refunds stay pending until reversal commits; admin cancel surface (AdminCancelGiftCard)
- Sweep: cancelled-booking charges failed+notified instead of silently completed; source-override replay uses live square_source_id; legacy square-less refund sweep; snapshot refresh on pending reuse
- Refund lock consolidation; recordTerminalPaymentTx shared recorder; structured Square error codes; terminal checkout CustomerID

GDPR / security:
- Notes retained as de-identified medical/safety record at erasure (single field treated as health data; rest of record wiped, no re-identification map) + comments updated per UK GDPR/Art 9/Equality Act 2010
- square_request_snapshot PII scrubbed on all erasure paths; delete_guest_user FK unlinks; verification codes + dispute reasons handled; idle/stale-guest erasure deletes Square cards/customers + CardDAV/R2
- Durable square-erasure outbox job (retry-square-erasures); 2FA dev/prod build split, pepper fail-closed, no prod code-in-log; prod 2FA delivery fail-loud without a channel
- Webhook unknown-type family split (non-money acked, money retried); untracked dispute notifications; rate-limit CF/X-Real-IP trust gating; nginx CSP nonce + api_limit

Frontend:
- Dynamic z-index stack (ui/dialog/zindex.ts) claimed in open order via data-state observer; re-claims on every reopen; removes stale !z-* overrides — nested modals (booking→user→booking) always paint newest-on-top (browser-verified 3-level + reopen)
- Mobile: iOS zoom fixes, bottom-sheet dialogs, 44px touch targets, inputmode decimal, dvh
- Gift-card buy/cancel UI, admin £250 + daily limits, cancellation/privacy/terms policy accuracy

S3:
- Connect() creates buckets before probing; in-memory fallback only on genuine unreachability; health reports degraded; stale S3_PUBLIC_URL documented (host-specific)

Tests/docs:
- 2263 test functions; all 22 backend packages green; round8/9/10 regression suites; NextEditWindowTime removes wall-clock flake; docs reconciled (notes retention, gift-card partial-use, modal T15 future work)

backend/handlers/bookings/edit_requests_test.go

@@ -1574,10 +1574,10 @@ func TestAdminApproveEditRequestHandler_OverlapWithBooking(t *testing.T) {
 
 	token := jwt.GenerateUserToken(userID)
 
-	// Create first booking at time T
-	// Use a start time <48h away so auto-approval doesn't trigger at request-
-	// creation time, allowing us to test the approval-time overlap check.
-	baseTime := clock.Now().Add(40 * time.Hour).Truncate(time.Second)
+	// Booking2 (at baseTime + dur/2) is the edited booking; its start must sit
+	// in the [24h,48h] window so RequestEditHandler neither 403s (too close) nor
+	// auto-approves at creation.
+	baseTime := fixtures.NextEditWindowTime(time.Duration(serviceDuration/2) * time.Minute)
 
 	booking1, err := fixtures.CreateTestBooking(tx, userID, serviceID)
 	if err != nil {

backend/handlers/bookings/overlap_test.go

@@ -840,9 +840,10 @@ func TestAdminApproveEditRequest_OverlapWithBooking_Regression(t *testing.T) {
 	}
 	dur := durationMinutes(t, ctx, tx, serviceID)
 
-	// Use <48h from now so RequestEditHandler does NOT auto-approve
-	nearTime := clock.Now().Add(40 * time.Hour)
-	nearTime = time.Date(nearTime.Year(), nearTime.Month(), nearTime.Day(), nearTime.Hour(), 0, 0, 0, nearTime.Location())
+	// Booking B (at +2h) is the edited booking; its start must sit in the
+	// [24h,48h] window so RequestEditHandler neither 403s (too close) nor
+	// auto-approves at creation. 10:00 UTC keeps it inside working hours.
+	nearTime := fixtures.NextEditWindowTime(2 * time.Hour)
 
 	token := jwt.GenerateUserToken(userID)
 
@@ -1852,14 +1853,9 @@ func TestAdminApproveEditRequest_EvictsPendingRelease(t *testing.T) {
 	}
 	dur := durationMinutes(t, ctx, tx, serviceID)
 
-	// Use a booking 24-48h from now at a fixed working-hour slot so RequestEdit
-	// neither 403s (<24h away = too close) nor auto-approves (>48h away would
-	// consume the edit request before the admin can approve it). A raw
-	// clock.Now().Add(Kh) can land after 19:00 London and fail closing hours.
-	nearTime := fixtures.NextWorkingDayAt(1, 10)
-	if nearTime.Sub(clock.Now()) < 24*time.Hour {
-		nearTime = fixtures.NextWorkingDayAt(2, 10)
-	}
+	// Booking A is the edited booking; its start must sit in the [24h,48h]
+	// window so RequestEditHandler neither 403s (too close) nor auto-approves.
+	nearTime := fixtures.NextEditWindowTime(0)
 
 	bookingA, err := fixtures.CreateTestBookingAtTime(tx, userID, serviceID, nearTime)
 	if err != nil {