fix: loop-B adversarial findings — tip-type double-charge, tip-refund capacity, loyalty stamp farming, gate ordering, auth amplification, admin audit log

Loop B restart (money/security/dup-mod adversarial) fixes:
- CRITICAL: CreateTerminalPayment rejects payment_type='tip' (mirrors CreateBookingPayment) — a tip-typed admin charge no longer records the FULL amount as a tip and double-collects (all is-paid computations exclude tip rows)
- HIGH: tip refunds can no longer re-open booking capacity — refunded_total subqueries filter payment_type <> 'tip' (service.go) and RefundPayment rejects tip rows
- MEDIUM: loyalty-stamp farming closed — stamp award once-per-booking via loyalty_stamp_awarded_at column (init-script.sql) + existing same-day guard
- MEDIUM: CreateTipPayment/CreateBookingPayment 2FA gates moved AFTER the idempotency completed-dedup (code consumed only on new money paths; terminal path already correct) — lost-response retries return the completed payment instead of 400
- MEDIUM: replayRescueLowerBoundSkew widened to 5m (DB-clock-skew stranded originals now rescued)
- MEDIUM-1: verifyFamilyAlive DB amplification reduced via 30s bounded family-alive cache; admin route group rate-limited
- MEDIUM-3: admin saved-card charges now write admin_audit_log (handlers.go helper + till); [2FA] log line decoupled from user identity
- LOW-1: logout scoped to the presented token's family (no cross-session kill)
- LOW-2: refresh-reuse grace widened for same-IP replays
- LOW-4: squareEnvironmentMismatch enforced for empty env
- LOW-5: uuid.ts hard-fails on Math.random fallback (crypto.randomUUID)
- Cash/giftcard tip-enabled overflow mirrors the card-terminal carve

26/26 backend packages; 72/72 frontend tests + build; env-docs 41/41.

backend/auth/jwt_test.go

@@ -519,13 +519,13 @@ func TestVerifyRefreshToken_ReuseRevokesFamilyAndAlerts(t *testing.T) {
 		t.Fatalf("expected 2 refresh tokens in family, got %d", famCount)
 	}
 
-	// MEDIUM 4 grace window: backdate the original's used_at past the 30s
-	// reuse grace so the replay below is genuine theft. WITHOUT this, a replay
+	// Reuse grace window: backdate the original's used_at past the 60s reuse
+	// grace so the replay below is genuine theft. WITHOUT this, a replay
 	// moments after rotation is a benign two-tab concurrent refresh and the
 	// family must NOT be killed.
 	if _, err := tx.Exec(ctx, `
 		UPDATE refresh_tokens
-		SET used_at = NOW() - make_interval(secs => 60)
+		SET used_at = NOW() - make_interval(secs => 120)
 		WHERE token_hash = encode(sha256($1::bytea), 'hex')
 	`, original); err != nil {
 		t.Fatalf("failed to backdate used_at for reuse test: %v", err)
@@ -572,8 +572,8 @@ func TestVerifyRefreshToken_ReuseRevokesFamilyAndAlerts(t *testing.T) {
 	}
 }
 
-// TestVerifyRefreshToken_ReplayWithinGrace_IsBenign verifies the MEDIUM 4
-// hardening: a used-token replay WITHIN the 30s grace window (two tabs sharing
+// TestVerifyRefreshToken_ReplayWithinGrace_IsBenign verifies the reuse
+// hardening: a used-token replay WITHIN the 60s grace window (two tabs sharing
 // one localStorage refresh token both refreshing on load) is a benign
 // concurrent refresh — the generic error is returned, but the rotation family
 // survives and no refresh_token_reuse alert is raised.
@@ -679,7 +679,7 @@ func TestAccessTokenKilledWithRotationFamily(t *testing.T) {
 	// detected, whole family DELETEd.
 	if _, err := tx.Exec(ctx, `
 		UPDATE refresh_tokens
-		SET used_at = NOW() - make_interval(secs => 60)
+		SET used_at = NOW() - make_interval(secs => 120)
 		WHERE token_hash = encode(sha256($1::bytea), 'hex')
 	`, original); err != nil {
 		t.Fatalf("failed to backdate used_at: %v", err)