fix: loop-B adversarial findings — tip-type double-charge, tip-refund capacity, loyalty stamp farming, gate ordering, auth amplification, admin audit log

Loop B restart (money/security/dup-mod adversarial) fixes:
- CRITICAL: CreateTerminalPayment rejects payment_type='tip' (mirrors CreateBookingPayment) — a tip-typed admin charge no longer records the FULL amount as a tip and double-collects (all is-paid computations exclude tip rows)
- HIGH: tip refunds can no longer re-open booking capacity — refunded_total subqueries filter payment_type <> 'tip' (service.go) and RefundPayment rejects tip rows
- MEDIUM: loyalty-stamp farming closed — stamp award once-per-booking via loyalty_stamp_awarded_at column (init-script.sql) + existing same-day guard
- MEDIUM: CreateTipPayment/CreateBookingPayment 2FA gates moved AFTER the idempotency completed-dedup (code consumed only on new money paths; terminal path already correct) — lost-response retries return the completed payment instead of 400
- MEDIUM: replayRescueLowerBoundSkew widened to 5m (DB-clock-skew stranded originals now rescued)
- MEDIUM-1: verifyFamilyAlive DB amplification reduced via 30s bounded family-alive cache; admin route group rate-limited
- MEDIUM-3: admin saved-card charges now write admin_audit_log (handlers.go helper + till); [2FA] log line decoupled from user identity
- LOW-1: logout scoped to the presented token's family (no cross-session kill)
- LOW-2: refresh-reuse grace widened for same-IP replays
- LOW-4: squareEnvironmentMismatch enforced for empty env
- LOW-5: uuid.ts hard-fails on Math.random fallback (crypto.randomUUID)
- Cash/giftcard tip-enabled overflow mirrors the card-terminal carve

26/26 backend packages; 72/72 frontend tests + build; env-docs 41/41.

backend/handlers/auth/auth_test.go

@@ -1414,6 +1414,110 @@ func TestLogoutHandler_InvalidToken(t *testing.T) {
 	}
 }
 
+// TestLogoutHandler_RevokesPresentedFamilyOnly pins the LOW-1 fix: logout must
+// revoke the refresh tokens of the PRESENTED access token's rotation family
+// (family_id claim), NOT every refresh token the user holds on other devices —
+// a stolen access token must not be able to wipe all sessions. A second,
+// unrelated rotation family for the same user survives the logout.
+func TestLogoutHandler_RevokesPresentedFamilyOnly(t *testing.T) {
+	t.Parallel()
+	ctx, tx := resetTestData(t)
+
+	userID, err := fixtures.CreateTestUser(tx)
+	if err != nil {
+		t.Fatalf("failed to create test user: %v", err)
+	}
+
+	// Two independent rotation families for the same user: A (the one being
+	// logged out) and B (a session on another device that must survive).
+	_, familyA, err := auth.GenerateRefreshToken(ctx, userID, "verified_email")
+	if err != nil {
+		t.Fatalf("failed to generate refresh token A: %v", err)
+	}
+	_, familyB, err := auth.GenerateRefreshToken(ctx, userID, "verified_email")
+	if err != nil {
+		t.Fatalf("failed to generate refresh token B: %v", err)
+	}
+	if familyA == familyB {
+		t.Fatal("expected two distinct rotation families")
+	}
+
+	// The presented access token is bound to family A (as LoginHandler and
+	// RefreshTokenHandler mint it).
+	token, jti, err := auth.GenerateTokenForFamily(userID, "verified_email", familyA)
+	if err != nil {
+		t.Fatalf("failed to generate family-bound access token: %v", err)
+	}
+
+	req := httptest.NewRequest("POST", "/api/logout", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	reqCtx := context.WithValue(ctx, mw.JTIKey, jti)
+	reqCtx = context.WithValue(reqCtx, mw.UserIDKey, userID)
+	req = req.WithContext(reqCtx)
+	w := httptest.NewRecorder()
+	LogoutHandler(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("logout failed: %d. body: %s", w.Code, w.Body.String())
+	}
+
+	countFamily := func(familyID string) int {
+		var n int
+		if err := tx.QueryRow(ctx, `SELECT COUNT(*) FROM refresh_tokens WHERE family_id = $1`, familyID).Scan(&n); err != nil {
+			t.Fatalf("failed to count family rows: %v", err)
+		}
+		return n
+	}
+	if got := countFamily(familyA); got != 0 {
+		t.Errorf("expected family A (presented token) to be revoked after logout, got %d rows", got)
+	}
+	if got := countFamily(familyB); got != 1 {
+		t.Errorf("expected family B (other device session) to survive logout, got %d rows", got)
+	}
+}
+
+// TestLogoutHandler_UnboundToken_RevokesUserWide pins the LOW-1 fallback: an
+// access token WITHOUT a family_id claim (test/legacy minting via
+// GenerateToken) cannot be scoped, so logout falls back to the historical
+// user-wide refresh-token delete.
+func TestLogoutHandler_UnboundToken_RevokesUserWide(t *testing.T) {
+	t.Parallel()
+	ctx, tx := resetTestData(t)
+
+	userID, err := fixtures.CreateTestUser(tx)
+	if err != nil {
+		t.Fatalf("failed to create test user: %v", err)
+	}
+	if _, _, err := auth.GenerateRefreshToken(ctx, userID, "verified_email"); err != nil {
+		t.Fatalf("failed to generate refresh token: %v", err)
+	}
+
+	token, jti, err := auth.GenerateToken(userID, "verified_email")
+	if err != nil {
+		t.Fatalf("failed to generate unbound access token: %v", err)
+	}
+
+	req := httptest.NewRequest("POST", "/api/logout", nil)
+	req.Header.Set("Authorization", "Bearer "+token)
+	reqCtx := context.WithValue(ctx, mw.JTIKey, jti)
+	reqCtx = context.WithValue(reqCtx, mw.UserIDKey, userID)
+	req = req.WithContext(reqCtx)
+	w := httptest.NewRecorder()
+	LogoutHandler(w, req)
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("logout failed: %d. body: %s", w.Code, w.Body.String())
+	}
+
+	var n int
+	if err := tx.QueryRow(ctx, `SELECT COUNT(*) FROM refresh_tokens WHERE user_id = $1`, userID).Scan(&n); err != nil {
+		t.Fatalf("failed to count refresh tokens: %v", err)
+	}
+	if n != 0 {
+		t.Errorf("expected all refresh tokens revoked for an unbound token, got %d rows", n)
+	}
+}
+
 // =============================================================================
 // Refresh Token JTI Tests
 // =============================================================================