fix: loop-B adversarial findings — tip-type double-charge, tip-refund capacity, loyalty stamp farming, gate ordering, auth amplification, admin audit log

Loop B restart (money/security/dup-mod adversarial) fixes:
- CRITICAL: CreateTerminalPayment rejects payment_type='tip' (mirrors CreateBookingPayment) — a tip-typed admin charge no longer records the FULL amount as a tip and double-collects (all is-paid computations exclude tip rows)
- HIGH: tip refunds can no longer re-open booking capacity — refunded_total subqueries filter payment_type <> 'tip' (service.go) and RefundPayment rejects tip rows
- MEDIUM: loyalty-stamp farming closed — stamp award once-per-booking via loyalty_stamp_awarded_at column (init-script.sql) + existing same-day guard
- MEDIUM: CreateTipPayment/CreateBookingPayment 2FA gates moved AFTER the idempotency completed-dedup (code consumed only on new money paths; terminal path already correct) — lost-response retries return the completed payment instead of 400
- MEDIUM: replayRescueLowerBoundSkew widened to 5m (DB-clock-skew stranded originals now rescued)
- MEDIUM-1: verifyFamilyAlive DB amplification reduced via 30s bounded family-alive cache; admin route group rate-limited
- MEDIUM-3: admin saved-card charges now write admin_audit_log (handlers.go helper + till); [2FA] log line decoupled from user identity
- LOW-1: logout scoped to the presented token's family (no cross-session kill)
- LOW-2: refresh-reuse grace widened for same-IP replays
- LOW-4: squareEnvironmentMismatch enforced for empty env
- LOW-5: uuid.ts hard-fails on Math.random fallback (crypto.randomUUID)
- Cash/giftcard tip-enabled overflow mirrors the card-terminal carve

26/26 backend packages; 72/72 frontend tests + build; env-docs 41/41.

backend/handlers/auth/local.go

@@ -576,11 +576,28 @@ func LogoutHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// B5: logging out must also kill every outstanding refresh token for this
-	// user, or a previously-issued (possibly stolen) refresh token would keep
-	// the session alive past logout. The 90-day credential is deleted from
-	// refresh_tokens, so no refresh request after logout can succeed.
-	if userID != "" {
+	// B5: logging out must also kill the outstanding refresh credential for
+	// THIS session, or a previously-issued (possibly stolen) refresh token
+	// would keep the session alive past logout.
+	//
+	// LOW-1: the revocation is scoped to the PRESENTED access token's rotation
+	// family (family_id claim) instead of every refresh token the user holds.
+	// A stolen access token can no longer wipe every session the user keeps on
+	// other devices — only this token's own lineage dies, which is all B5
+	// needs (the presented refresh token lives in that family). An unbound
+	// token (no family_id claim — test/legacy minting via GenerateToken)
+	// falls back to the user-wide delete, preserving the old behaviour for
+	// those tokens.
+	familyID := auth.FamilyIDFromToken(strings.TrimPrefix(r.Header.Get("Authorization"), "Bearer "))
+	if familyID != "" {
+		if _, err := db.Conn.Exec(r.Context(), `DELETE FROM refresh_tokens WHERE family_id = $1`, familyID); err != nil {
+			slog.Error("logout: failed to revoke refresh token family", "familyID", familyID, "err", err)
+		}
+		// Drop the family-alive cache verdict so this family's access tokens
+		// (the logged-out one and any in-flight duplicates) are re-checked
+		// against the now-empty refresh_tokens on their next request.
+		auth.InvalidateFamilyAlive(familyID)
+	} else if userID != "" {
 		if _, err := db.Conn.Exec(r.Context(), `DELETE FROM refresh_tokens WHERE user_id = $1`, userID); err != nil {
 			slog.Error("logout: failed to revoke refresh tokens", "userID", userID, "err", err)
 		}