fix: loop-B adversarial findings — tip-type double-charge, tip-refund capacity, loyalty stamp farming, gate ordering, auth amplification, admin audit log

Loop B restart (money/security/dup-mod adversarial) fixes:
- CRITICAL: CreateTerminalPayment rejects payment_type='tip' (mirrors CreateBookingPayment) — a tip-typed admin charge no longer records the FULL amount as a tip and double-collects (all is-paid computations exclude tip rows)
- HIGH: tip refunds can no longer re-open booking capacity — refunded_total subqueries filter payment_type <> 'tip' (service.go) and RefundPayment rejects tip rows
- MEDIUM: loyalty-stamp farming closed — stamp award once-per-booking via loyalty_stamp_awarded_at column (init-script.sql) + existing same-day guard
- MEDIUM: CreateTipPayment/CreateBookingPayment 2FA gates moved AFTER the idempotency completed-dedup (code consumed only on new money paths; terminal path already correct) — lost-response retries return the completed payment instead of 400
- MEDIUM: replayRescueLowerBoundSkew widened to 5m (DB-clock-skew stranded originals now rescued)
- MEDIUM-1: verifyFamilyAlive DB amplification reduced via 30s bounded family-alive cache; admin route group rate-limited
- MEDIUM-3: admin saved-card charges now write admin_audit_log (handlers.go helper + till); [2FA] log line decoupled from user identity
- LOW-1: logout scoped to the presented token's family (no cross-session kill)
- LOW-2: refresh-reuse grace widened for same-IP replays
- LOW-4: squareEnvironmentMismatch enforced for empty env
- LOW-5: uuid.ts hard-fails on Math.random fallback (crypto.randomUUID)
- Cash/giftcard tip-enabled overflow mirrors the card-terminal carve

26/26 backend packages; 72/72 frontend tests + build; env-docs 41/41.

backend/handlers/payments/service.go

@@ -483,6 +483,10 @@ func (s *PaymentService) GetBookingPaymentInfo(ctx context.Context, bookingID st
 			FROM refunds r
 			JOIN payments p ON r.payment_id = p.id
 			WHERE p.booking_id = $1 AND r.status IN ('completed', 'pending')
+			  -- Tips are excluded from TotalPaid above, so a tip refund must
+			  -- equally be excluded here — otherwise a refunded tip would
+			  -- subtract from the paid total and re-open booking capacity.
+			  AND p.payment_type <> 'tip'
 			GROUP BY p.booking_id
 		) rr ON b.id = rr.booking_id
 		WHERE b.id = $1
@@ -521,6 +525,10 @@ func (s *PaymentService) GetBookingRemainingBalancePence(ctx context.Context, bo
 			FROM refunds r
 			JOIN payments p ON r.payment_id = p.id
 			WHERE p.booking_id = $1 AND r.status = 'completed'
+			  -- A tip refund returns gratuity, not booking money — it must not
+			  -- re-open booking charge capacity (mirror of the paid_total tip
+			  -- exclusion above).
+			  AND p.payment_type <> 'tip'
 		)
 		-- Money-safety (M-cap): refunds return money, so they re-open booking
 		-- capacity — remaining = total - paid + refunded. LEAST clamps the cap