fix: round-3 — tip gate asymmetry, webhook VAT align + 503 notifications, cash-tip campaign overcharge, lockout DoS, erasure durability, S3 retry cap, env parsing, per-user rate limiters, consume dead code, frontend 2FA remnants

- tip gate: CreateTipPayment saved-card 2FA gate now has scaTokenizedSavedCard skip matching every other charge surface (booking, terminal, gift-card); isSCATokenizeResultShape escape added to tip SAVE gate
- webhook: align UPDATE clears VAT fields before re-apply (matches sweep rescue); 503 unknown-event tracking with 24h timeout notification via square_webhook_events table
- cash-tip: cashChargeBasePence no longer restores campaign or subtracts loyalty — overcharge and tip shortfall fixed; 2FA dead code remnants removed from gift-card buy flow; TwoFactorCodeInput help text deconfused; refund pre-fill unit mismatch fixed (pounds vs pence); SCA buyer names split from full_name; passwordless delete UI accepts empty password
- lockout: successful current-password clears shared failed_attempts/locked_until (victim can recover from login lockout via password change); passwordless delete condition changed to require 2FA only in enforced env
- erasure: stale-guest batch erasure persists Square card/customer targets to durable outbox before NULLing them (crash-safe); S3 deletion retry capped at 10 attempts with admin notification; S3_PROFILE_PICS_BUCKET startup check added
- env parsing: IsExplicitDevOrMockEnv and Square HTTP client base-URL switch now normalize (ToLower+TrimSpace) for consistency
- auth: change-password/delete-account get per-user rate limiters (10/min); consume param dead code suppressed with TODO
- frontend: 2FA/SCA dead code removed from gift-card buy flow, TwoFactorCodeInput help text fixed, refund pre-fill unit mismatch fixed, buyer names populated from full_name

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

backend/internal/square/square_http_client.go

@@ -92,7 +92,7 @@ func SquareLocationID() string {
 }
 
 func newHTTPClient() *httpClient {
-	env := SquareEnvironment()
+	env := strings.ToLower(strings.TrimSpace(SquareEnvironment()))
 	baseURL := squareSandboxURL
 	// Empty/unknown SQUARE_ENVIRONMENT is production-ENFORCED, mirroring
 	// payments.IsExplicitDevOrMockEnv()'s fail-closed interpretation (an

backend/internal/square/square_http_client_test.go

@@ -2170,6 +2170,11 @@ func TestNewHTTPClient_BaseURLSelection(t *testing.T) {
 		{name: "sandbox_env", env: "sandbox", want: squareSandboxURL},
 		{name: "mock_env", env: "mock", want: squareSandboxURL},
 		{name: "dev_env", env: "dev", want: squareSandboxURL},
+		// FIX 5: env normalization — lowercased + trimmed before comparison.
+		{name: "uppercase_production_is_production", env: "PRODUCTION", want: squareProductionURL},
+		{name: "trailing_space_production_is_production", env: "Production ", want: squareProductionURL},
+		{name: "uppercase_sandbox_is_sandbox", env: "SANDBOX", want: squareSandboxURL},
+		{name: "surrounded_space_mock_is_sandbox", env: "  Mock  ", want: squareSandboxURL},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {