Fix frontend payment flows: BookingFlow fetch loop, shared TipPayment, card icons, terms route

Fix the P0 infinite refetch in BookingFlow (payment-methods fetched once via a guard flag, was looping on empty saved-card arrays and DoS-ing the rate limiter). Extract the shared TipPayment component so tip and pay-tip routes no longer drift; reconcile formatTimeRange override_duration_minutes and subtotal/tipsPaid. CardBrandIcon gains the correct Square enum keys (DISCOVER_DINERS, CHINA_UNIONPAY). PaymentModal reads card_last4. Login links resolve to the new /terms and /privacy-policy routes. Add frontend/.env.example.

frontend/.env.example

@@ -0,0 +1,15 @@
+VITE_BACKEND_URL=http://localhost:8080
+
+# Square Web Payments SDK — local dev runs the built-in frontend mock:
+# VITE_SQUARE_ENVIRONMENT=mock makes SquareCardInput render a plain HTML card
+# form and tokenize() return the deterministic cnon: tokens the backend dev
+# mock (SQUARE_ENVIRONMENT=mock) accepts — a full end-to-end walkthrough with
+# zero real Square credentials. Card data stays in local component state;
+# the backend still only ever receives cnon: tokens.
+#
+# For real sandbox/production testing, uncomment the two IDs below and set
+# VITE_SQUARE_ENVIRONMENT=sandbox|production. NEVER set 'mock' in a deployed
+# (non-local) build.
+# VITE_SQUARE_APPLICATION_ID=sandbox-sq0idb-xxxx
+# VITE_SQUARE_LOCATION_ID=xxxx
+VITE_SQUARE_ENVIRONMENT=mock