fix: round-3 — tip gate asymmetry, webhook VAT align + 503 notifications, cash-tip campaign overcharge, lockout DoS, erasure durability, S3 retry cap, env parsing, per-user rate limiters, consume dead code, frontend 2FA remnants

- tip gate: CreateTipPayment saved-card 2FA gate now has scaTokenizedSavedCard skip matching every other charge surface (booking, terminal, gift-card); isSCATokenizeResultShape escape added to tip SAVE gate
- webhook: align UPDATE clears VAT fields before re-apply (matches sweep rescue); 503 unknown-event tracking with 24h timeout notification via square_webhook_events table
- cash-tip: cashChargeBasePence no longer restores campaign or subtracts loyalty — overcharge and tip shortfall fixed; 2FA dead code remnants removed from gift-card buy flow; TwoFactorCodeInput help text deconfused; refund pre-fill unit mismatch fixed (pounds vs pence); SCA buyer names split from full_name; passwordless delete UI accepts empty password
- lockout: successful current-password clears shared failed_attempts/locked_until (victim can recover from login lockout via password change); passwordless delete condition changed to require 2FA only in enforced env
- erasure: stale-guest batch erasure persists Square card/customer targets to durable outbox before NULLing them (crash-safe); S3 deletion retry capped at 10 attempts with admin notification; S3_PROFILE_PICS_BUCKET startup check added
- env parsing: IsExplicitDevOrMockEnv and Square HTTP client base-URL switch now normalize (ToLower+TrimSpace) for consistency
- auth: change-password/delete-account get per-user rate limiters (10/min); consume param dead code suppressed with TODO
- frontend: 2FA/SCA dead code removed from gift-card buy flow, TwoFactorCodeInput help text fixed, refund pre-fill unit mismatch fixed, buyer names populated from full_name

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

backend/internal/s3/s3.go

@@ -17,6 +17,13 @@ var Client Uploader
 // uses the in-memory fallback client.
 var FallbackToInMemory bool
 
+// ClientIsStub reports whether the active client is the production stub that
+// cannot perform real S3 operations. It is always true in the !dev build:
+// every operation (Upload, Download, Delete) returns "not implemented" because
+// the AWS SDK v2 is not compiled in. main.go uses it to warn at startup so the
+// operator knows that profile-picture deletion will never succeed in this build.
+var ClientIsStub = true
+
 type Uploader interface {
 	Upload(ctx context.Context, bucket, key string, body io.Reader, contentType string) error
 	Download(ctx context.Context, bucket, key string, w io.Writer) error

backend/internal/s3/s3_dev.go

@@ -26,6 +26,11 @@ var Client Uploader
 // main.go can surface it from the health endpoint in both build variants.
 var FallbackToInMemory bool
 
+// ClientIsStub mirrors the prod-build flag so main.go can reference it in dev
+// builds. It is always false here: the dev build compiles the real AWS SDK
+// client and is never the "not implemented" stub.
+var ClientIsStub = false
+
 type Uploader interface {
 	Upload(ctx context.Context, bucket, key string, body io.Reader, contentType string) error
 	Download(ctx context.Context, bucket, key string, w io.Writer) error

backend/internal/s3/s3_test.go

@@ -0,0 +1,34 @@
+//go:build !dev
+
+package s3
+
+import (
+	"context"
+	"strings"
+	"testing"
+)
+
+// TestProdClientIsStub verifies the production (!dev) build's S3 client is
+// flagged as the stub: main.go uses ClientIsStub to warn at startup that
+// object-store operations (including profile-picture deletion) cannot perform
+// real work in this build.
+func TestProdClientIsStub(t *testing.T) {
+	if !ClientIsStub {
+		t.Error("expected ClientIsStub to be true in the !dev build (the client is the 'not implemented' stub)")
+	}
+}
+
+// TestProdStubDeleteNotImplemented verifies the prod stub's Delete always fails
+// with a "not implemented" error — the retry-s3-deletions job cannot drain any
+// outbox row in this build, so the attempt cap + critical notification is the
+// only signal the operator gets.
+func TestProdStubDeleteNotImplemented(t *testing.T) {
+	c := &S3Client{bucket: "b", endpoint: "http://localhost:9000"}
+	err := c.Delete(context.Background(), "test-bucket", "profiles/x.jpg")
+	if err == nil {
+		t.Fatal("expected the prod stub Delete to return an error")
+	}
+	if !strings.Contains(err.Error(), "not implemented") {
+		t.Errorf("expected the prod stub Delete error to say 'not implemented', got: %v", err)
+	}
+}