fix: round-3 — tip gate asymmetry, webhook VAT align + 503 notifications, cash-tip campaign overcharge, lockout DoS, erasure durability, S3 retry cap, env parsing, per-user rate limiters, consume dead code, frontend 2FA remnants

- tip gate: CreateTipPayment saved-card 2FA gate now has scaTokenizedSavedCard skip matching every other charge surface (booking, terminal, gift-card); isSCATokenizeResultShape escape added to tip SAVE gate
- webhook: align UPDATE clears VAT fields before re-apply (matches sweep rescue); 503 unknown-event tracking with 24h timeout notification via square_webhook_events table
- cash-tip: cashChargeBasePence no longer restores campaign or subtracts loyalty — overcharge and tip shortfall fixed; 2FA dead code remnants removed from gift-card buy flow; TwoFactorCodeInput help text deconfused; refund pre-fill unit mismatch fixed (pounds vs pence); SCA buyer names split from full_name; passwordless delete UI accepts empty password
- lockout: successful current-password clears shared failed_attempts/locked_until (victim can recover from login lockout via password change); passwordless delete condition changed to require 2FA only in enforced env
- erasure: stale-guest batch erasure persists Square card/customer targets to durable outbox before NULLing them (crash-safe); S3 deletion retry capped at 10 attempts with admin notification; S3_PROFILE_PICS_BUCKET startup check added
- env parsing: IsExplicitDevOrMockEnv and Square HTTP client base-URL switch now normalize (ToLower+TrimSpace) for consistency
- auth: change-password/delete-account get per-user rate limiters (10/min); consume param dead code suppressed with TODO
- frontend: 2FA/SCA dead code removed from gift-card buy flow, TwoFactorCodeInput help text fixed, refund pre-fill unit mismatch fixed, buyer names populated from full_name

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

backend/startup_checks_test.go

@@ -11,6 +11,8 @@ import (
 	"strings"
 	"testing"
 
+	"crussell/internal/s3"
+
 	"github.com/stretchr/testify/require"
 )
 
@@ -177,3 +179,54 @@ func TestCheckWebhookSignatureKey_FatalBranch_Exits(t *testing.T) {
 		})
 	}
 }
+
+// TestCheckS3ProfilePicsBucket pins the S3_PROFILE_PICS_BUCKET startup check
+// (FIX 3): a dev/mock env skips it, a configured bucket is silent, an unset
+// bucket without R2_ENDPOINT warns, and an unset bucket WITH a configured
+// R2_ENDPOINT (active S3 client, silently-skipped deletions) elevates to
+// CRITICAL.
+func TestCheckS3ProfilePicsBucket(t *testing.T) {
+	t.Run("mock_env_skips_check", func(t *testing.T) {
+		t.Setenv("SQUARE_ENVIRONMENT", "mock")
+		t.Setenv("S3_PROFILE_PICS_BUCKET", "")
+		t.Setenv("R2_ENDPOINT", "")
+		got := captureLog(t, checkS3ProfilePicsBucket)
+		require.Empty(t, got, "a dev/mock env must skip the check: %s", got)
+	})
+
+	t.Run("bucket_configured_silent", func(t *testing.T) {
+		t.Setenv("SQUARE_ENVIRONMENT", "production")
+		t.Setenv("S3_PROFILE_PICS_BUCKET", "crussell-profile-pics")
+		t.Setenv("R2_ENDPOINT", "https://r2.example.com")
+		got := captureLog(t, checkS3ProfilePicsBucket)
+		require.Empty(t, got, "a configured bucket must be silent: %s", got)
+	})
+
+	t.Run("unset_bucket_without_endpoint_warns", func(t *testing.T) {
+		t.Setenv("SQUARE_ENVIRONMENT", "production")
+		t.Setenv("S3_PROFILE_PICS_BUCKET", "")
+		t.Setenv("R2_ENDPOINT", "")
+		got := captureLog(t, checkS3ProfilePicsBucket)
+		require.Contains(t, got, "WARNING", "an unset bucket without R2_ENDPOINT must warn: %s", got)
+		require.NotContains(t, got, "CRITICAL", "an unset bucket without R2_ENDPOINT must not be CRITICAL: %s", got)
+	})
+
+	t.Run("unset_bucket_with_endpoint_critical", func(t *testing.T) {
+		t.Setenv("SQUARE_ENVIRONMENT", "production")
+		t.Setenv("S3_PROFILE_PICS_BUCKET", "")
+		t.Setenv("R2_ENDPOINT", "https://r2.example.com")
+		got := captureLog(t, checkS3ProfilePicsBucket)
+		require.Contains(t, got, "CRITICAL", "an unset bucket with an active R2_ENDPOINT must elevate to CRITICAL: %s", got)
+	})
+
+	t.Run("stub_client_warns_even_with_bucket", func(t *testing.T) {
+		t.Setenv("SQUARE_ENVIRONMENT", "production")
+		t.Setenv("S3_PROFILE_PICS_BUCKET", "crussell-profile-pics")
+		t.Setenv("R2_ENDPOINT", "https://r2.example.com")
+		orig := s3.ClientIsStub
+		s3.ClientIsStub = true
+		defer func() { s3.ClientIsStub = orig }()
+		got := captureLog(t, checkS3ProfilePicsBucket)
+		require.Contains(t, got, "CRITICAL", "a stub client must warn even when the bucket is set: %s", got)
+	})
+}