fix: round-3 — tip gate asymmetry, webhook VAT align + 503 notifications, cash-tip campaign overcharge, lockout DoS, erasure durability, S3 retry cap, env parsing, per-user rate limiters, consume dead code, frontend 2FA remnants

- tip gate: CreateTipPayment saved-card 2FA gate now has scaTokenizedSavedCard skip matching every other charge surface (booking, terminal, gift-card); isSCATokenizeResultShape escape added to tip SAVE gate
- webhook: align UPDATE clears VAT fields before re-apply (matches sweep rescue); 503 unknown-event tracking with 24h timeout notification via square_webhook_events table
- cash-tip: cashChargeBasePence no longer restores campaign or subtracts loyalty — overcharge and tip shortfall fixed; 2FA dead code remnants removed from gift-card buy flow; TwoFactorCodeInput help text deconfused; refund pre-fill unit mismatch fixed (pounds vs pence); SCA buyer names split from full_name; passwordless delete UI accepts empty password
- lockout: successful current-password clears shared failed_attempts/locked_until (victim can recover from login lockout via password change); passwordless delete condition changed to require 2FA only in enforced env
- erasure: stale-guest batch erasure persists Square card/customer targets to durable outbox before NULLing them (crash-safe); S3 deletion retry capped at 10 attempts with admin notification; S3_PROFILE_PICS_BUCKET startup check added
- env parsing: IsExplicitDevOrMockEnv and Square HTTP client base-URL switch now normalize (ToLower+TrimSpace) for consistency
- auth: change-password/delete-account get per-user rate limiters (10/min); consume param dead code suppressed with TODO
- frontend: 2FA/SCA dead code removed from gift-card buy flow, TwoFactorCodeInput help text fixed, refund pre-fill unit mismatch fixed, buyer names populated from full_name

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

backend/main.go

@@ -346,6 +346,34 @@ func checkSquareCredentials() {
 	square.ValidateCredentials()
 }
 
+// checkS3ProfilePicsBucket warns at startup when S3_PROFILE_PICS_BUCKET is
+// unset in a non-dev/mock deployment. The bucket is only needed for profile-pic
+// deletion operations, not for the app to function, so this is a WARNING not a
+// Fatal. If R2_ENDPOINT is set (S3 client configured) but the bucket is not,
+// the warning is elevated to CRITICAL because the deletion path will be silently
+// skipped at runtime — every profile-pic erasure will log a one-time CRITICAL
+// and skip the S3 deletion, leaving the object in place.
+func checkS3ProfilePicsBucket() {
+	if payments.IsExplicitDevOrMockEnv() {
+		return
+	}
+	bucket := os.Getenv("S3_PROFILE_PICS_BUCKET")
+	r2Endpoint := os.Getenv("R2_ENDPOINT")
+	switch {
+	case bucket != "":
+		// The deletion path can run, but a non-dev build's S3 client is the
+		// "not implemented" stub — every Delete fails and the retry job will
+		// eventually hit its attempt cap and raise a critical notification.
+		if s3.ClientIsStub {
+			log.Printf("CRITICAL: this build's S3 client is the stub that cannot perform real operations — profile-picture deletions will always fail (retry-s3-deletions will exhaust its attempts and raise a critical admin notification). Compile with the real AWS SDK (dev build) or implement the production S3 client before relying on R2 object-store erasure.")
+		}
+	case r2Endpoint != "":
+		log.Printf("CRITICAL: S3_PROFILE_PICS_BUCKET is not set but R2_ENDPOINT=%q is configured — the S3 client is active but profile-picture deletion will be silently skipped at runtime (every erasure logs a one-time CRITICAL and skips the S3 delete). Set S3_PROFILE_PICS_BUCKET to the bucket holding profile pictures.", r2Endpoint)
+	default:
+		log.Printf("WARNING: S3_PROFILE_PICS_BUCKET is not set — profile-picture deletion from object storage will be skipped. This is safe if no object store is configured; set it when R2_ENDPOINT is configured.")
+	}
+}
+
 func healthCheckHandler(w http.ResponseWriter, r *http.Request) {
 	status := "ok"
 	services := map[string]string{
@@ -463,6 +491,7 @@ func main() {
 	initDB()
 	initDav()
 	initS3()
+	checkS3ProfilePicsBucket()
 	initSquare()
 
 	sched := jobs.New()
@@ -656,7 +685,15 @@ func main() {
 
 			r.Get("/user/profile", user.GetProfileHandler)
 			r.Put("/user/profile", user.UpdateProfileHandler)
-			r.Put("/user/change-password", user.ChangePasswordHandler)
+			// Change-password and delete-account get a dedicated per-user limiter
+			// (10/min) on top of the group's generic 120/min per-IP limiter:
+			// these endpoints re-verify the current password, and without a
+			// per-user budget a stolen session token lets an attacker brute-force
+			// that password with unlimited guesses (the account lockout is the
+			// last line of defence; the per-user limiter is the first).
+			accountLimiter := mw.RateLimitByUser(10, time.Minute)
+			r.With(accountLimiter).Put("/user/change-password", user.ChangePasswordHandler)
+			r.With(accountLimiter).Delete("/user/account", user.DeleteAccountHandler)
 			r.Get("/user/notification-preferences", user.GetNotificationPreferencesHandler)
 			r.Put("/user/notification-preferences", user.UpdateNotificationPreferencesHandler)
 			// 2FA settings — merchant-level authorization gate on saved-card