fix: loop-B adversarial findings — tip-type double-charge, tip-refund capacity, loyalty stamp farming, gate ordering, auth amplification, admin audit log

Loop B restart (money/security/dup-mod adversarial) fixes:
- CRITICAL: CreateTerminalPayment rejects payment_type='tip' (mirrors CreateBookingPayment) — a tip-typed admin charge no longer records the FULL amount as a tip and double-collects (all is-paid computations exclude tip rows)
- HIGH: tip refunds can no longer re-open booking capacity — refunded_total subqueries filter payment_type <> 'tip' (service.go) and RefundPayment rejects tip rows
- MEDIUM: loyalty-stamp farming closed — stamp award once-per-booking via loyalty_stamp_awarded_at column (init-script.sql) + existing same-day guard
- MEDIUM: CreateTipPayment/CreateBookingPayment 2FA gates moved AFTER the idempotency completed-dedup (code consumed only on new money paths; terminal path already correct) — lost-response retries return the completed payment instead of 400
- MEDIUM: replayRescueLowerBoundSkew widened to 5m (DB-clock-skew stranded originals now rescued)
- MEDIUM-1: verifyFamilyAlive DB amplification reduced via 30s bounded family-alive cache; admin route group rate-limited
- MEDIUM-3: admin saved-card charges now write admin_audit_log (handlers.go helper + till); [2FA] log line decoupled from user identity
- LOW-1: logout scoped to the presented token's family (no cross-session kill)
- LOW-2: refresh-reuse grace widened for same-IP replays
- LOW-4: squareEnvironmentMismatch enforced for empty env
- LOW-5: uuid.ts hard-fails on Math.random fallback (crypto.randomUUID)
- Cash/giftcard tip-enabled overflow mirrors the card-terminal carve

26/26 backend packages; 72/72 frontend tests + build; env-docs 41/41.

backend/handlers/auth/auth_test.go

@@ -1414,6 +1414,110 @@ func TestLogoutHandler_InvalidToken(t *testing.T) {
 	}
 }
 
+// TestLogoutHandler_RevokesPresentedFamilyOnly pins the LOW-1 fix: logout must
+// revoke the refresh tokens of the PRESENTED access token's rotation family
+// (family_id claim), NOT every refresh token the user holds on other devices —
+// a stolen access token must not be able to wipe all sessions. A second,
+// unrelated rotation family for the same user survives the logout.
+func TestLogoutHandler_RevokesPresentedFamilyOnly(t *testing.T) {
+	t.Parallel()
+	ctx, tx := resetTestData(t)
+
+	userID, err := fixtures.CreateTestUser(tx)
+	if err != nil {
+		t.Fatalf("failed to create test user: %v", err)
+	}
+
+	// Two independent rotation families for the same user: A (the one being
+	// logged out) and B (a session on another device that must survive).
+	_, familyA, err := auth.GenerateRefreshToken(ctx, userID, "verified_email")
+	if err != nil {
+		t.Fatalf("failed to generate refresh token A: %v", err)
+	}
+	_, familyB, err := auth.GenerateRefreshToken(ctx, userID, "verified_email")
+	if err != nil {
+		t.Fatalf("failed to generate refresh token B: %v", err)
+	}
+	if familyA == familyB {
+		t.Fatal("expected two distinct rotation families")
+	}
+
+	// The presented access token is bound to family A (as LoginHandler and
+	// RefreshTokenHandler mint it).
+	token, jti, err := auth.GenerateTokenForFamily(userID, "verified_email", familyA)
+	if err != nil {
+		t.Fatalf("failed to generate family-bound access token: %v", err)
+	}
+
+	req := httptest.NewRequest("POST", "/api/logout", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	reqCtx := context.WithValue(ctx, mw.JTIKey, jti)
+	reqCtx = context.WithValue(reqCtx, mw.UserIDKey, userID)
+	req = req.WithContext(reqCtx)
+	w := httptest.NewRecorder()
+	LogoutHandler(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("logout failed: %d. body: %s", w.Code, w.Body.String())
+	}
+
+	countFamily := func(familyID string) int {
+		var n int
+		if err := tx.QueryRow(ctx, `SELECT COUNT(*) FROM refresh_tokens WHERE family_id = $1`, familyID).Scan(&n); err != nil {
+			t.Fatalf("failed to count family rows: %v", err)
+		}
+		return n
+	}
+	if got := countFamily(familyA); got != 0 {
+		t.Errorf("expected family A (presented token) to be revoked after logout, got %d rows", got)
+	}
+	if got := countFamily(familyB); got != 1 {
+		t.Errorf("expected family B (other device session) to survive logout, got %d rows", got)
+	}
+}
+
+// TestLogoutHandler_UnboundToken_RevokesUserWide pins the LOW-1 fallback: an
+// access token WITHOUT a family_id claim (test/legacy minting via
+// GenerateToken) cannot be scoped, so logout falls back to the historical
+// user-wide refresh-token delete.
+func TestLogoutHandler_UnboundToken_RevokesUserWide(t *testing.T) {
+	t.Parallel()
+	ctx, tx := resetTestData(t)
+
+	userID, err := fixtures.CreateTestUser(tx)
+	if err != nil {
+		t.Fatalf("failed to create test user: %v", err)
+	}
+	if _, _, err := auth.GenerateRefreshToken(ctx, userID, "verified_email"); err != nil {
+		t.Fatalf("failed to generate refresh token: %v", err)
+	}
+
+	token, jti, err := auth.GenerateToken(userID, "verified_email")
+	if err != nil {
+		t.Fatalf("failed to generate unbound access token: %v", err)
+	}
+
+	req := httptest.NewRequest("POST", "/api/logout", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	reqCtx := context.WithValue(ctx, mw.JTIKey, jti)
+	reqCtx = context.WithValue(reqCtx, mw.UserIDKey, userID)
+	req = req.WithContext(reqCtx)
+	w := httptest.NewRecorder()
+	LogoutHandler(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("logout failed: %d. body: %s", w.Code, w.Body.String())
+	}
+
+	var n int
+	if err := tx.QueryRow(ctx, `SELECT COUNT(*) FROM refresh_tokens WHERE user_id = $1`, userID).Scan(&n); err != nil {
+		t.Fatalf("failed to count refresh tokens: %v", err)
+	}
+	if n != 0 {
+		t.Errorf("expected all refresh tokens revoked for an unbound token, got %d rows", n)
+	}
+}
+
 // =============================================================================
 // Refresh Token JTI Tests
 // =============================================================================

backend/handlers/auth/local.go

@@ -576,11 +576,28 @@ func LogoutHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// B5: logging out must also kill every outstanding refresh token for this
-	// user, or a previously-issued (possibly stolen) refresh token would keep
-	// the session alive past logout. The 90-day credential is deleted from
-	// refresh_tokens, so no refresh request after logout can succeed.
-	if userID != "" {
+	// B5: logging out must also kill the outstanding refresh credential for
+	// THIS session, or a previously-issued (possibly stolen) refresh token
+	// would keep the session alive past logout.
+	//
+	// LOW-1: the revocation is scoped to the PRESENTED access token's rotation
+	// family (family_id claim) instead of every refresh token the user holds.
+	// A stolen access token can no longer wipe every session the user keeps on
+	// other devices — only this token's own lineage dies, which is all B5
+	// needs (the presented refresh token lives in that family). An unbound
+	// token (no family_id claim — test/legacy minting via GenerateToken)
+	// falls back to the user-wide delete, preserving the old behaviour for
+	// those tokens.
+	familyID := auth.FamilyIDFromToken(strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer "))
+	if familyID != "" {
+		if _, err := db.Conn.Exec(r.Context(), `DELETE FROM refresh_tokens WHERE family_id = $1`, familyID); err != nil {
+			slog.Error("logout: failed to revoke refresh token family", "familyID", familyID, "err", err)
+		}
+		// Drop the family-alive cache verdict so this family's access tokens
+		// (the logged-out one and any in-flight duplicates) are re-checked
+		// against the now-empty refresh_tokens on their next request.
+		auth.InvalidateFamilyAlive(familyID)
+	} else if userID != "" {
 		if _, err := db.Conn.Exec(r.Context(), `DELETE FROM refresh_tokens WHERE user_id = $1`, userID); err != nil {
 			slog.Error("logout: failed to revoke refresh tokens", "userID", userID, "err", err)
 		}