fix: round-3 — tip gate asymmetry, webhook VAT align + 503 notifications, cash-tip campaign overcharge, lockout DoS, erasure durability, S3 retry cap, env parsing, per-user rate limiters, consume dead code, frontend 2FA remnants

- tip gate: CreateTipPayment saved-card 2FA gate now has scaTokenizedSavedCard skip matching every other charge surface (booking, terminal, gift-card); isSCATokenizeResultShape escape added to tip SAVE gate
- webhook: align UPDATE clears VAT fields before re-apply (matches sweep rescue); 503 unknown-event tracking with 24h timeout notification via square_webhook_events table
- cash-tip: cashChargeBasePence no longer restores campaign or subtracts loyalty — overcharge and tip shortfall fixed; 2FA dead code remnants removed from gift-card buy flow; TwoFactorCodeInput help text deconfused; refund pre-fill unit mismatch fixed (pounds vs pence); SCA buyer names split from full_name; passwordless delete UI accepts empty password
- lockout: successful current-password clears shared failed_attempts/locked_until (victim can recover from login lockout via password change); passwordless delete condition changed to require 2FA only in enforced env
- erasure: stale-guest batch erasure persists Square card/customer targets to durable outbox before NULLing them (crash-safe); S3 deletion retry capped at 10 attempts with admin notification; S3_PROFILE_PICS_BUCKET startup check added
- env parsing: IsExplicitDevOrMockEnv and Square HTTP client base-URL switch now normalize (ToLower+TrimSpace) for consistency
- auth: change-password/delete-account get per-user rate limiters (10/min); consume param dead code suppressed with TODO
- frontend: 2FA/SCA dead code removed from gift-card buy flow, TwoFactorCodeInput help text fixed, refund pre-fill unit mismatch fixed, buyer names populated from full_name

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

frontend/src/lib/square/square.ts

@@ -62,27 +62,30 @@ export function buildCashTillPaymentBody(
 }
 
 /**
- * The cash till-sale charge base in pence, aligned with the backend's
- * CreateTerminalPayment tip carve (backend/handlers/payments/handlers.go
- * ~577-630). The backend derives the recorded tip from `amount − remaining`,
+ * The cash till-sale charge base in pence. The backend's
+ * CreateTerminalPayment derives the recorded tip from `amount − remaining`,
  * where `remaining` comes from GetBookingRemainingBalancePence (service.go) —
- * which does NOT subtract the pending campaign discount: campaigns auto-apply
- * AFTER the remaining is read, minting `payment_method='discount'` rows that
- * never reduce the balance. If the frontend charges the campaign-reduced total
- * (`totalDuePence`), the sent amount is smaller than the backend's remaining,
- * so `amount − remaining` is absorbed (the tip is under-recorded or the whole
- * payment lands as booking credit). Restoring the campaign credit into the
- * charge base keeps the sent amount on the same basis the backend carves
- * against. `totalDuePence` is the net total (campaign already subtracted,
- * pre-loyalty), `campaignPence` the eligible preview credit and `loyaltyPence`
- * the redemption being applied on top.
+ * which does NOT subtract the pending campaign discount or loyalty discount
+ * (both mint `payment_method='discount'` rows that never reduce the balance).
+ * The charge base must therefore be the FULL totalDuePence — neither the
+ * campaign credit nor the loyalty discount is subtracted, because the backend
+ * applies both at completion via separate discount rows. The campaign and
+ * loyalty parameters are kept for call-site compatibility (the calling modals
+ * still compute them for display) but are deliberately unused in the
+ * arithmetic: subtracting them would undercharge the booking and cause the
+ * backend's tip carve (`amount − remaining`) to absorb the tip or record a
+ * negative tip.
+ *
+ * FIX-1/FIX-2: `campaignPence` and `loyaltyPence` are accepted but IGNORED.
+ * The correct charge base is the full total due, with campaign and loyalty
+ * applied server-side at completion.
  */
 export function cashChargeBasePence(
 	totalDuePence: number,
-	campaignPence: number,
-	loyaltyPence: number
+	_campaignPence: number,
+	_loyaltyPence: number
 ): number {
-	return Math.max(0, totalDuePence - loyaltyPence + campaignPence);
+	return Math.max(0, totalDuePence);
 }
 
 /**