fix: loop-B adversarial findings — tip-type double-charge, tip-refund capacity, loyalty stamp farming, gate ordering, auth amplification, admin audit log

Loop B restart (money/security/dup-mod adversarial) fixes:
- CRITICAL: CreateTerminalPayment rejects payment_type='tip' (mirrors CreateBookingPayment) — a tip-typed admin charge no longer records the FULL amount as a tip and double-collects (all is-paid computations exclude tip rows)
- HIGH: tip refunds can no longer re-open booking capacity — refunded_total subqueries filter payment_type <> 'tip' (service.go) and RefundPayment rejects tip rows
- MEDIUM: loyalty-stamp farming closed — stamp award once-per-booking via loyalty_stamp_awarded_at column (init-script.sql) + existing same-day guard
- MEDIUM: CreateTipPayment/CreateBookingPayment 2FA gates moved AFTER the idempotency completed-dedup (code consumed only on new money paths; terminal path already correct) — lost-response retries return the completed payment instead of 400
- MEDIUM: replayRescueLowerBoundSkew widened to 5m (DB-clock-skew stranded originals now rescued)
- MEDIUM-1: verifyFamilyAlive DB amplification reduced via 30s bounded family-alive cache; admin route group rate-limited
- MEDIUM-3: admin saved-card charges now write admin_audit_log (handlers.go helper + till); [2FA] log line decoupled from user identity
- LOW-1: logout scoped to the presented token's family (no cross-session kill)
- LOW-2: refresh-reuse grace widened for same-IP replays
- LOW-4: squareEnvironmentMismatch enforced for empty env
- LOW-5: uuid.ts hard-fails on Math.random fallback (crypto.randomUUID)
- Cash/giftcard tip-enabled overflow mirrors the card-terminal carve

26/26 backend packages; 72/72 frontend tests + build; env-docs 41/41.

backend/handlers/payments/till.go

@@ -17,6 +17,7 @@ import (
 
 	"crussell/db"
 	"crussell/internal/square"
+	"crussell/internal/twofa"
 	"crussell/internal/validators"
 	"crussell/mw"
 
@@ -888,6 +889,11 @@ func CreateTillSale(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 
+	// cardUserID is the owner of the charged saved card (till sales are not
+	// user-scoped). Resolved in the saved_card case below; hoisted here because
+	// the post-charge 2FA consumption + audit after the Square call need it.
+	var cardUserID sql.NullString
+
 	switch req.PaymentMethod {
 	case "cash":
 		saleStatus = "completed"
@@ -909,13 +915,14 @@ func CreateTillSale(w http.ResponseWriter, r *http.Request) {
 
 		// The till path is not user-scoped, so fetch the card's owner along with
 		// the charge details — the owner is needed to lazily provision a Square
-		// customer if the row predates P14 (R6).
-		var cardUserID sql.NullString
+		// customer if the row predates P14 (R6). cardUserID is declared at
+		// function scope (before the switch) because the post-charge 2FA
+		// consumption + audit need it after the Square call.
 		err = tx.QueryRow(ctx, `
-			SELECT user_id, COALESCE(square_card_id, ''), COALESCE(square_customer_id, '')
-			FROM user_saved_cards
-			WHERE id = $1 AND deleted_at IS NULL
-		`, *req.UserSavedCardID).Scan(&cardUserID, &savedCardSqCardID, &savedCardCustomerID)
+		SELECT user_id, COALESCE(square_card_id, ''), COALESCE(square_customer_id, '')
+		FROM user_saved_cards
+		WHERE id = $1 AND deleted_at IS NULL
+	`, *req.UserSavedCardID).Scan(&cardUserID, &savedCardSqCardID, &savedCardCustomerID)
 		if err != nil {
 			log.Printf("Failed to get saved card details: %v", err)
 			http.Error(w, "Card not found", http.StatusNotFound)
@@ -947,8 +954,12 @@ func CreateTillSale(w http.ResponseWriter, r *http.Request) {
 		}
 
 		// 2FA gating (C5): charging a customer's saved card requires 2FA when
-		// the feature is enforced.
-		if cardUserID.Valid && !requireTwoFactorForCardAccess(w, r, service, cardUserID.String, req.VerificationCode) {
+		// the feature is enforced. consume=false (MEDIUM-2): the code is
+		// verified here but only NULLed once the charge reaches its terminal
+		// success state below (ConsumePendingCode), so a failed/ambiguous
+		// Square charge does NOT burn the operator-relayed code and a same-key
+		// retry can re-verify the SAME code.
+		if cardUserID.Valid && !requireTwoFactorForCardAccess(w, r, service, cardUserID.String, req.VerificationCode, false) {
 			return
 		}
 
@@ -1274,6 +1285,28 @@ func CreateTillSale(w http.ResponseWriter, r *http.Request) {
 			return
 		}
 
+		// MEDIUM-2: a saved-card till charge reached its terminal SUCCESS state
+		// — consume the verified 2FA code now (the gate verified without
+		// consuming, so a failed/ambiguous charge did not burn the code and a
+		// same-key retry could reuse it). Best-effort after the completion
+		// write: a consume failure cannot undo the completed sale, it only
+		// leaves the code valid until its 10-minute expiry.
+		if req.PaymentMethod == "saved_card" && cardUserID.Valid {
+			if consErr := twofa.ConsumePendingCode(ctx, db.Conn, cardUserID.String); consErr != nil {
+				log.Printf("CRITICAL: Square payment %s succeeded but consuming the 2FA code for user %s failed: %v — MANUAL RECONCILIATION REQUIRED", paymentResult.SquarePayID, cardUserID.String, consErr)
+			}
+			// MEDIUM-3a: record the admin-initiated saved-card till charge in
+			// admin_audit_log (mirroring giftcards.go's balance_check audit).
+			insertAdminAuditCharge(ctx, adminID, cardUserID.String, "till_saved_card_charge", map[string]any{
+				"till_sale_id":      tillSaleID,
+				"item_type":         req.ItemType,
+				"gift_card_id":      giftCardID,
+				"amount":            req.Amount,
+				"card_last4":        paymentResult.CardLast4,
+				"square_payment_id": paymentResult.SquarePayID,
+			})
+		}
+
 		saleStatus = "completed"
 	}