fix: round-3 — tip gate asymmetry, webhook VAT align + 503 notifications, cash-tip campaign overcharge, lockout DoS, erasure durability, S3 retry cap, env parsing, per-user rate limiters, consume dead code, frontend 2FA remnants

- tip gate: CreateTipPayment saved-card 2FA gate now has scaTokenizedSavedCard skip matching every other charge surface (booking, terminal, gift-card); isSCATokenizeResultShape escape added to tip SAVE gate
- webhook: align UPDATE clears VAT fields before re-apply (matches sweep rescue); 503 unknown-event tracking with 24h timeout notification via square_webhook_events table
- cash-tip: cashChargeBasePence no longer restores campaign or subtracts loyalty — overcharge and tip shortfall fixed; 2FA dead code remnants removed from gift-card buy flow; TwoFactorCodeInput help text deconfused; refund pre-fill unit mismatch fixed (pounds vs pence); SCA buyer names split from full_name; passwordless delete UI accepts empty password
- lockout: successful current-password clears shared failed_attempts/locked_until (victim can recover from login lockout via password change); passwordless delete condition changed to require 2FA only in enforced env
- erasure: stale-guest batch erasure persists Square card/customer targets to durable outbox before NULLing them (crash-safe); S3 deletion retry capped at 10 attempts with admin notification; S3_PROFILE_PICS_BUCKET startup check added
- env parsing: IsExplicitDevOrMockEnv and Square HTTP client base-URL switch now normalize (ToLower+TrimSpace) for consistency
- auth: change-password/delete-account get per-user rate limiters (10/min); consume param dead code suppressed with TODO
- frontend: 2FA/SCA dead code removed from gift-card buy flow, TwoFactorCodeInput help text fixed, refund pre-fill unit mismatch fixed, buyer names populated from full_name

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

frontend/src/lib/components/admin/EditBookingModal.svelte

@@ -348,7 +348,9 @@
 
 	async function openRefundModal(payment: Payment) {
 		refundPaymentId = payment.id;
-		refundAmount = (payment.amount / 100).toFixed(2);
+		// payment.amount is in POUNDS (float64) — no /100 here. Pre-fill with
+		// the full amount; the payment-summary residual below overrides it.
+		refundAmount = payment.amount.toFixed(2);
 		refundAlreadyRefundedPence = 0;
 		refundReason = '';
 		// Unique per refund attempt so two equal partial refunds of the same
@@ -375,8 +377,11 @@
 					.filter((r) => r.payment_id === payment.id && r.status === 'completed')
 					.reduce((sum, r) => sum + r.amount, 0);
 				if (alreadyRefunded > 0) {
+					// `alreadyRefunded` is PENCE (payment-summary refund rows) while
+					// payment.amount is POUNDS — convert to pounds before subtracting
+					// so a partially refunded payment pre-fills the correct residual.
 					refundAlreadyRefundedPence = alreadyRefunded;
-					refundAmount = (Math.max(0, payment.amount - alreadyRefunded) / 100).toFixed(2);
+					refundAmount = Math.max(0, payment.amount - alreadyRefunded / 100).toFixed(2);
 				}
 			}
 		} catch {

frontend/src/lib/components/payments/TwoFactorCodeInput.svelte

@@ -41,13 +41,13 @@
 				class="mt-1 font-mono tracking-widest"
 			/>
 			<p class="mt-1 text-xs text-gray-500">
-				Your bank doesn't support in-app approval — enter the code sent to you / your phone.
+				Your card doesn't support in-app approval — please try a different card or payment method.
 			</p>
 		</div>
 	{:else}
 		<div class="rounded-md border border-amber-200 bg-amber-50 p-3">
 			<p class="text-sm text-amber-800">
-				Two-factor authentication is required to use online card payments.
+				Secure card verification is required for this payment method.
 				<a href={resolve('/account')} class="font-medium underline"
 					>Enable it in your account settings</a
 				>.

frontend/src/lib/components/today/CurrentAppointment.svelte

@@ -877,8 +877,16 @@
 </Card.Root>
 
 {#if showPaymentModal && activeAppointment}
+	{@const firstName = activeAppointment.user?.full_name?.split(' ')[0] || ''}
+	{@const lastName = activeAppointment.user?.full_name?.split(' ').slice(1).join(' ') || ''}
+	{@const bookingWithNames = {
+		...activeAppointment,
+		user: activeAppointment.user
+			? { ...activeAppointment.user, first_name: firstName, last_name: lastName }
+			: undefined
+	}}
 	<PaymentModal
-		booking={activeAppointment as BookingType}
+		booking={bookingWithNames as BookingType}
 		onClose={() => (showPaymentModal = false)}
 		onComplete={handlePaymentComplete}
 	/>