fix: loop-B adversarial findings — tip-type double-charge, tip-refund capacity, loyalty stamp farming, gate ordering, auth amplification, admin audit log

Loop B restart (money/security/dup-mod adversarial) fixes:
- CRITICAL: CreateTerminalPayment rejects payment_type='tip' (mirrors CreateBookingPayment) — a tip-typed admin charge no longer records the FULL amount as a tip and double-collects (all is-paid computations exclude tip rows)
- HIGH: tip refunds can no longer re-open booking capacity — refunded_total subqueries filter payment_type <> 'tip' (service.go) and RefundPayment rejects tip rows
- MEDIUM: loyalty-stamp farming closed — stamp award once-per-booking via loyalty_stamp_awarded_at column (init-script.sql) + existing same-day guard
- MEDIUM: CreateTipPayment/CreateBookingPayment 2FA gates moved AFTER the idempotency completed-dedup (code consumed only on new money paths; terminal path already correct) — lost-response retries return the completed payment instead of 400
- MEDIUM: replayRescueLowerBoundSkew widened to 5m (DB-clock-skew stranded originals now rescued)
- MEDIUM-1: verifyFamilyAlive DB amplification reduced via 30s bounded family-alive cache; admin route group rate-limited
- MEDIUM-3: admin saved-card charges now write admin_audit_log (handlers.go helper + till); [2FA] log line decoupled from user identity
- LOW-1: logout scoped to the presented token's family (no cross-session kill)
- LOW-2: refresh-reuse grace widened for same-IP replays
- LOW-4: squareEnvironmentMismatch enforced for empty env
- LOW-5: uuid.ts hard-fails on Math.random fallback (crypto.randomUUID)
- Cash/giftcard tip-enabled overflow mirrors the card-terminal carve

26/26 backend packages; 72/72 frontend tests + build; env-docs 41/41.

backend/handlers/payments/completion.go

@@ -80,6 +80,16 @@ func ApplyBookingCompletionSideEffects(ctx context.Context, tx pgx.Tx, bookingID
 
 	var newStampCount int
 	if bookingTotal > 0 && !loyaltyAppliedOnThisBooking {
+		// Loop B MEDIUM (stamp farming via refund + re-charge): the stamp must
+		// be awarded at most ONCE per booking, no matter how many times the
+		// booking is re-completed. A refund never moves the booking out of
+		// 'in_progress', so a re-payment re-completes it — without this guard
+		// each in_progress→completed transition would re-award a stamp with no
+		// net merchant cash flow. The bookings.loyalty_stamp_awarded_at marker
+		// blocks a booking that already earned its stamp; the marker is written
+		// (same tx) only when the award actually landed, so a daily-cap-blocked
+		// completion does not permanently forfeit the booking's stamp. The
+		// existing "no OTHER completed booking within a day" cap is kept.
 		if err := tx.QueryRow(ctx, `
 			UPDATE users
 			SET loyalty_stamps = loyalty_stamps + 1
@@ -91,6 +101,10 @@ func ApplyBookingCompletionSideEffects(ctx context.Context, tx pgx.Tx, bookingID
 				AND b.updated_at >= CURRENT_DATE - INTERVAL '1 day'
 				AND b.id != $2
 			)
+			AND NOT EXISTS (
+				SELECT 1 FROM bookings b
+				WHERE b.id = $2 AND b.loyalty_stamp_awarded_at IS NOT NULL
+			)
 			RETURNING loyalty_stamps
 		`, userID, bookingID).Scan(&newStampCount); err != nil {
 			if !errors.Is(err, pgx.ErrNoRows) {
@@ -98,6 +112,14 @@ func ApplyBookingCompletionSideEffects(ctx context.Context, tx pgx.Tx, bookingID
 			}
 		}
 	}
+	if newStampCount > 0 {
+		if _, err := tx.Exec(ctx, `
+			UPDATE bookings SET loyalty_stamp_awarded_at = NOW()
+			WHERE id = $1 AND loyalty_stamp_awarded_at IS NULL
+		`, bookingID); err != nil {
+			log.Printf("Failed to mark loyalty stamp awarded for booking %s: %v", bookingID, err)
+		}
+	}
 
 	// Create pending redemption when stamps reach LoyaltyStampCost
 	if newStampCount == LoyaltyStampCost {