fix: review round — B1 clock-skew tolerance + re-poll escalation, refresh-token access-token revocation, shared 2FA composable, per-package-DB test alignment

Three fresh reviews (money/security/dup-mod) cross-validated findings:
- MEDIUM: B1 'new charge' discrimination adds a lower-bound tolerance (replayRescueLowerBoundSkew) so a retained-key replay of the ORIGINAL charge (DB clock ahead of Square) is never auto-refunded; ambiguous margins leave PENDING + CRITICAL
- MEDIUM: B1 re-poll escalates after stalePendingB1RefundAge (48h) — FAILED/REJECTED refunds go terminal (fail parent, claw back till-sale funding, CRITICAL notification); no more unbounded re-polling / stranded parents without webhooks
- DRIFT-REAL: processManualPaymentGroup now checks PENDING/FAILED/REJECTED on the synchronous refund response (mirrors processChargeGroup/manual handler) — no more premature 'completed'
- HIGH: refresh-token family kill now also invalidates the attacker's freshly-minted ACCESS token — access tokens carry a family_id claim and VerifyToken rejects tokens whose family was deleted (GenerateTokenForFamily + family-alive check); 30s grace window for concurrent two-tab refresh (no false theft alert)
- LOW: 2FA mint endpoint returns remaining_seconds; in-memory 2FA counters documented; 90-day refresh expiry single-sourced (RefreshTokenLifetime + make_interval)
- Dup/mod: NEW shared useTwoFactorCodeForSavedCard Svelte composable replaces 6 surface copies of the 2FA gate logic (Request-a-new-code added to BookingFlow + TillPurchases); account page adopts generateUUID
- Test architecture: removed t.Parallel() from 8 global-SquareClient-swapping tests per Testing Architecture doc line 89 (B1 flaky-test lesson) — fixes within-package race
- SQL alias pence rename (total_cents/paid_cents -> total_pence/paid_pence)

26/26 backend packages; 72/72 frontend tests + build; env-docs 41/41.

backend/handlers/scheduling/scheduled-cleanup.go

@@ -8,6 +8,7 @@ import (
 	"log/slog"
 	"time"
 
+	"crussell/auth"
 	"crussell/clock"
 	"crussell/db"
 
@@ -229,7 +230,7 @@ func CleanupExpiredVerificationCodes(ctx context.Context) (int, error) {
 }
 
 // CleanupExpiredRefreshTokens deletes expired refresh tokens and
-// revoked tokens older than 90 days.
+// revoked tokens older than the shared RefreshTokenLifetime window (auth).
 func CleanupExpiredRefreshTokens(ctx context.Context) (int, error) {
 	tx, err := db.Conn.Begin(ctx)
 	if err != nil {
@@ -244,8 +245,8 @@ func CleanupExpiredRefreshTokens(ctx context.Context) (int, error) {
 	result, err := tx.Exec(ctx, `
 		DELETE FROM refresh_tokens
 		WHERE expires_at < NOW()
-		   OR (revoked = TRUE AND created_at < NOW() - INTERVAL '90 days')
-	`)
+		   OR (revoked = TRUE AND created_at < NOW() - make_interval(days => $1))
+	`, int64(auth.RefreshTokenLifetime/(24*time.Hour)))
 	if err != nil {
 		return 0, fmt.Errorf("failed to cleanup refresh tokens: %w", err)
 	}