fix: review-loop hardening — identical-body replay, 2FA gates, webhook at-least-once, GDPR scrub

Follow-up to the comprehensive payment-system review. Fixes the issues the
review found in the initial integration, plus the rough edges it introduced.

Money-safety:
- Replay-by-key now replays the FULL original request verbatim from a stored
  square_request_snapshot, so a retained idempotency key returns the original
  payment instead of IDEMPOTENCY_KEY_REUSED (previously the row sat pending
  forever). IDEMPOTENCY_KEY_REUSED remains ambiguous (never proof of no charge).
- Dev mock mirrors real Square for unknown-key replays: ccof: saved-card
  sources are charged and rescued; spent cnon: nonces surface
  ErrReplayKeyNotRetained. (Fixes dev/prod parity divergence.)
- Webhook dedup row committed AFTER dispatch (at-least-once); FAILED till sales
  claw back gift-card funding; event-type strings match Square's real catalog.
- Expired-gift-card cancellation refunds set creditFailed (never a phantom
  'completed' refund); cancellation refunds lock all payment rows ascending.
- Sweep never rescue-completes a gift-card purchase without delivering the card.
- Tip no-client-key fallback is a deterministic count-based key under the
  booking advisory lock (retry-safe, distinct tips don't collapse).
- M-cap subtracts completed refunds, clamped to [0, total].

2FA (PSD2 SCA stand-in) for online saved-card payments:
- Full feature: status/setup/verify/disable endpoints, gating helper wired into
  all 7 saved-card charge paths (incl. BuyGiftCard + admin saved-card), account
  admin-tab settings UI, frontend gating across all payment surfaces.
- Enforcement is FAIL-CLOSED: on unless REQUIRE_2FA=false or an explicit
  mock/dev SQUARE_ENVIRONMENT; startup warning when off in a non-dev env.
- Verify is brute-force hardened (5-attempt lockout, timing-safe compare);
  plaintext codes only logged when enforcement is off (dev).
- GDPR: anonymize_user also scrubs 2FA columns and staff notes.

Infra/docs:
- nginx: /api/ response cache removed (cross-user disclosure); port 80
  redirects to HTTPS (localhost/RFC1918 exempt, end-anchored regexes); HSTS;
  separate webhook rate-limit zone.
- Schema: users 2FA columns; payments/till_sales square_source_id +
  square_request_snapshot.
- Legal docs: gift-card cooling-off, international-transfers section, tips
  policy; Gap Backlog P3 webhooks marked done; stale counts/wording corrected.
- Flaky test race fixed (t.Parallel + global mock mutation); suite 26/26
  packages green, 2,142 tests, svelte-check clean.

backend/handlers/payments/service.go

@@ -57,12 +57,17 @@ type PaymentRecord struct {
 	NetAmount       *float64
 	UserSavedCardID *string
 	SquarePaymentID *string
-	IdempotencyKey  *string
-	Fees            float64
-	CreatedAt       time.Time
-	UpdatedAt       time.Time
-	CreatedBy       *string
-	GiftCardID      *string
+	// SquareSourceID is the exact source_id (cnon: nonce or ccof: card id) sent
+	// in the CreatePayment call, stored on the pending row so the sweep can
+	// replay the charge with an IDENTICAL request body under the same
+	// idempotency key.
+	SquareSourceID *string
+	IdempotencyKey *string
+	Fees           float64
+	CreatedAt      time.Time
+	UpdatedAt      time.Time
+	CreatedBy      *string
+	GiftCardID     *string
 }
 
 type RefundRecord struct {
@@ -129,8 +134,8 @@ func (s *PaymentService) insertPaymentRecord(ctx context.Context, record Payment
 			booking_id, payment_type, payment_method, vendor_code, invoice_number,
 			status, amount, is_vat_applicable, vat_rate, vat_amount, net_amount,
 			user_saved_card_id, square_payment_id, idempotency_key, fees, created_at, updated_at, created_by,
-			gift_card_id
-		) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19)
+			gift_card_id, square_source_id
+		) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16, $17, $18, $19, $20)
 		RETURNING id
 	`,
 		bookingID,
@@ -152,6 +157,7 @@ func (s *PaymentService) insertPaymentRecord(ctx context.Context, record Payment
 		record.UpdatedAt,
 		record.CreatedBy,
 		giftCardID,
+		record.SquareSourceID,
 	).Scan(&id)
 
 	if err != nil {
@@ -509,9 +515,21 @@ func (s *PaymentService) GetBookingRemainingBalanceCents(ctx context.Context, bo
 			  -- A tip is money paid beyond the booking total — it does not
 			  -- reduce the balance owed, so it must not count as "paid".
 			  AND payment_type <> 'tip'
+		),
+		refunded_total AS (
+			SELECT COALESCE(SUM(r.amount), 0) AS refunded_pounds
+			FROM refunds r
+			JOIN payments p ON r.payment_id = p.id
+			WHERE p.booking_id = $1 AND r.status = 'completed'
 		)
-		SELECT GREATEST(0, ROUND((bt.total_pounds - pt.paid_pounds) * 100))::bigint
-		FROM booking_total bt, paid_total pt
+		-- Money-safety (M-cap): refunds return money, so they re-open booking
+		-- capacity — remaining = total - paid + refunded. LEAST clamps the cap
+		-- at the booking total so the M-cap can never allow a charge beyond the
+		-- booking's full value even in the pathological case where completed
+		-- refunds exceed payments, and GREATEST floors at 0 so a fully-paid
+		-- (or over-paid) booking can never be charged again.
+		SELECT GREATEST(0, ROUND(LEAST(bt.total_pounds - pt.paid_pounds + rt.refunded_pounds, bt.total_pounds) * 100))::bigint
+		FROM booking_total bt, paid_total pt, refunded_total rt
 	`, bookingID).Scan(&remainingCents)
 	if err != nil {
 		return 0, err