fix: payments review rounds — money-safety, GDPR, security, gift-card cancel, modal stacking

Money-safety:
- Deterministic till idempotency fallback (Square-charging only); cash/on_the_house keep unique keys; £250 till gift-card cap; 45-char key validation
- Gift-card admin caps £250/tx + £5,000/day; user buy £500/day; BuyGiftCard allowlist unchanged
- CancelGiftCard: CCR 2013 14-day right with partial-spend refund of the unspent balance (spend verified via payments.gift_card_id); atomic vs redeem/transfer; refunds stay pending until reversal commits; admin cancel surface (AdminCancelGiftCard)
- Sweep: cancelled-booking charges failed+notified instead of silently completed; source-override replay uses live square_source_id; legacy square-less refund sweep; snapshot refresh on pending reuse
- Refund lock consolidation; recordTerminalPaymentTx shared recorder; structured Square error codes; terminal checkout CustomerID

GDPR / security:
- Notes retained as de-identified medical/safety record at erasure (single field treated as health data; rest of record wiped, no re-identification map) + comments updated per UK GDPR/Art 9/Equality Act 2010
- square_request_snapshot PII scrubbed on all erasure paths; delete_guest_user FK unlinks; verification codes + dispute reasons handled; idle/stale-guest erasure deletes Square cards/customers + CardDAV/R2
- Durable square-erasure outbox job (retry-square-erasures); 2FA dev/prod build split, pepper fail-closed, no prod code-in-log; prod 2FA delivery fail-loud without a channel
- Webhook unknown-type family split (non-money acked, money retried); untracked dispute notifications; rate-limit CF/X-Real-IP trust gating; nginx CSP nonce + api_limit

Frontend:
- Dynamic z-index stack (ui/dialog/zindex.ts) claimed in open order via data-state observer; re-claims on every reopen; removes stale !z-* overrides — nested modals (booking→user→booking) always paint newest-on-top (browser-verified 3-level + reopen)
- Mobile: iOS zoom fixes, bottom-sheet dialogs, 44px touch targets, inputmode decimal, dvh
- Gift-card buy/cancel UI, admin £250 + daily limits, cancellation/privacy/terms policy accuracy

S3:
- Connect() creates buckets before probing; in-memory fallback only on genuine unreachability; health reports degraded; stale S3_PUBLIC_URL documented (host-specific)

Tests/docs:
- 2263 test functions; all 22 backend packages green; round8/9/10 regression suites; NextEditWindowTime removes wall-clock flake; docs reconciled (notes retention, gift-card partial-use, modal T15 future work)

backend/mw/ratelimit.go

@@ -137,14 +137,23 @@ func RateLimit(limit int, window time.Duration) func(http.Handler) http.Handler
 }
 
 // clientIP derives the per-client rate-limit key. Priority:
-//  1. CF-Connecting-IP header (set only when Cloudflare is the edge;
-//     nginx never sets it, so it cannot be spoofed through our proxy)
-//  2. middleware.GetClientIP(r.Context()) — the X-Real-IP value nginx sets,
-//     captured by middleware.ClientIPFromHeader("X-Real-IP") in main.go
-//  3. net.SplitHostPort(r.RemoteAddr) / r.RemoteAddr fallback
+//  1. CF-Connecting-IP header — honored ONLY when TRUST_PROXY_HEADERS=true
+//     (see trustProxyHeaders). A trusted edge (Cloudflare, or nginx whose
+//     real_ip module validated it against the set_real_ip_from ranges) has
+//     already overwritten it with the real client IP, so it is unspoofable
+//     there. Ignored by default because an origin-exposed backend must never
+//     trust a client-controlled value.
+//  2. middleware.GetClientIP(r.Context()) — the X-Real-IP value nginx sets
+//     from $remote_addr, captured by middleware.ClientIPFromHeader("X-Real-IP")
+//     in main.go. That middleware is registered only when
+//     TRUST_PROXY_HEADERS=true, so it too is trusted solely behind a proxy.
+//  3. net.SplitHostPort(r.RemoteAddr) / r.RemoteAddr fallback — the actual
+//     TCP peer; the only key source usable when the backend is origin-exposed.
 func clientIP(r *http.Request) string {
-	if ip := r.Header.Get("CF-Connecting-IP"); ip != "" {
-		return ip
+	if trustProxyHeaders {
+		if ip := r.Header.Get("CF-Connecting-IP"); ip != "" {
+			return ip
+		}
 	}
 	if ip := middleware.GetClientIP(r.Context()); ip != "" {
 		return ip