fix: review-loop hardening — identical-body replay, 2FA gates, webhook at-least-once, GDPR scrub

Follow-up to the comprehensive payment-system review. Fixes the issues the
review found in the initial integration, plus the rough edges it introduced.

Money-safety:
- Replay-by-key now replays the FULL original request verbatim from a stored
  square_request_snapshot, so a retained idempotency key returns the original
  payment instead of IDEMPOTENCY_KEY_REUSED (previously the row sat pending
  forever). IDEMPOTENCY_KEY_REUSED remains ambiguous (never proof of no charge).
- Dev mock mirrors real Square for unknown-key replays: ccof: saved-card
  sources are charged and rescued; spent cnon: nonces surface
  ErrReplayKeyNotRetained. (Fixes dev/prod parity divergence.)
- Webhook dedup row committed AFTER dispatch (at-least-once); FAILED till sales
  claw back gift-card funding; event-type strings match Square's real catalog.
- Expired-gift-card cancellation refunds set creditFailed (never a phantom
  'completed' refund); cancellation refunds lock all payment rows ascending.
- Sweep never rescue-completes a gift-card purchase without delivering the card.
- Tip no-client-key fallback is a deterministic count-based key under the
  booking advisory lock (retry-safe, distinct tips don't collapse).
- M-cap subtracts completed refunds, clamped to [0, total].

2FA (PSD2 SCA stand-in) for online saved-card payments:
- Full feature: status/setup/verify/disable endpoints, gating helper wired into
  all 7 saved-card charge paths (incl. BuyGiftCard + admin saved-card), account
  admin-tab settings UI, frontend gating across all payment surfaces.
- Enforcement is FAIL-CLOSED: on unless REQUIRE_2FA=false or an explicit
  mock/dev SQUARE_ENVIRONMENT; startup warning when off in a non-dev env.
- Verify is brute-force hardened (5-attempt lockout, timing-safe compare);
  plaintext codes only logged when enforcement is off (dev).
- GDPR: anonymize_user also scrubs 2FA columns and staff notes.

Infra/docs:
- nginx: /api/ response cache removed (cross-user disclosure); port 80
  redirects to HTTPS (localhost/RFC1918 exempt, end-anchored regexes); HSTS;
  separate webhook rate-limit zone.
- Schema: users 2FA columns; payments/till_sales square_source_id +
  square_request_snapshot.
- Legal docs: gift-card cooling-off, international-transfers section, tips
  policy; Gap Backlog P3 webhooks marked done; stale counts/wording corrected.
- Flaky test race fixed (t.Parallel + global mock mutation); suite 26/26
  packages green, 2,142 tests, svelte-check clean.

backend/handlers/user/gdpr_test.go

@@ -517,7 +517,11 @@ func TestAnonymizeUser_ClearsNotificationPrefs(t *testing.T) {
 	}
 }
 
-func TestAnonymizeUser_PreservesNotes(t *testing.T) {
+// TestAnonymizeUser_Scrubs2FAAndNotes verifies the GDPR erasure gap closure:
+// anonymize_user() alone leaves the 2FA columns and staff notes on the row, so
+// the Go-side scrub (run in the same transaction by DeleteAccountHandler) must
+// null them.
+func TestAnonymizeUser_Scrubs2FAAndNotes(t *testing.T) {
 	t.Parallel()
 	ctx, tx := testutils.SetupTestTx(t)
 
@@ -527,11 +531,16 @@ func TestAnonymizeUser_PreservesNotes(t *testing.T) {
 	}
 
 	_, err = tx.Exec(ctx, `
-		UPDATE users SET notes = 'Client prefers quiet appointments and has a cat allergy'
+		UPDATE users SET
+			notes = 'Client prefers quiet appointments and has a cat allergy',
+			two_factor_enabled = TRUE,
+			two_factor_method = 'email',
+			two_factor_pending_code_hash = 'abc123',
+			two_factor_pending_code_expires = NOW() + INTERVAL '10 minutes'
 		WHERE id = $1
 	`, userID)
 	if err != nil {
-		t.Fatalf("failed to set user notes: %v", err)
+		t.Fatalf("failed to set user notes + 2FA: %v", err)
 	}
 
 	_, err = tx.Exec(ctx, `SELECT anonymize_user($1)`, userID)
@@ -539,17 +548,98 @@ func TestAnonymizeUser_PreservesNotes(t *testing.T) {
 		t.Fatalf("anonymize_user failed: %v", err)
 	}
 
-	var notes, lastLoginAt interface{}
-	err = tx.QueryRow(ctx, `SELECT notes, last_login_at FROM users WHERE id = $1`, userID).Scan(&notes, &lastLoginAt)
+	// Mirror DeleteAccountHandler: scrub after anonymize_user in the same tx.
+	if err := scrubAnonymizedUser2FA(ctx, tx, userID); err != nil {
+		t.Fatalf("scrubAnonymizedUser2FA failed: %v", err)
+	}
+
+	var notes interface{}
+	var enabled bool
+	var method, pendingHash, pendingExpires interface{}
+	err = tx.QueryRow(ctx, `
+		SELECT notes, two_factor_enabled, two_factor_method,
+		       two_factor_pending_code_hash, two_factor_pending_code_expires
+		FROM users WHERE id = $1
+	`, userID).Scan(&notes, &enabled, &method, &pendingHash, &pendingExpires)
 	if err != nil {
-		t.Fatalf("failed to query user notes: %v", err)
+		t.Fatalf("failed to query user after anonymization: %v", err)
 	}
-	// Notes should be preserved (contain business-critical info like allergies)
-	if notes == nil {
-		t.Errorf("expected users.notes to be preserved after anonymization, got NULL")
+	if notes != nil {
+		t.Errorf("expected users.notes to be NULL after erasure, got %v", notes)
 	}
-	if lastLoginAt != nil {
-		t.Errorf("expected users.last_login_at to be NULL after anonymization, got %v", lastLoginAt)
+	if enabled {
+		t.Error("expected two_factor_enabled to be FALSE after erasure")
+	}
+	if method != nil {
+		t.Errorf("expected two_factor_method to be NULL after erasure, got %v", method)
+	}
+	if pendingHash != nil {
+		t.Errorf("expected two_factor_pending_code_hash to be NULL after erasure, got %v", pendingHash)
+	}
+	if pendingExpires != nil {
+		t.Errorf("expected two_factor_pending_code_expires to be NULL after erasure, got %v", pendingExpires)
+	}
+}
+
+// TestDeleteAccount_Scrubs2FAAndNotes runs the full DeleteAccountHandler for a
+// user with 2FA enabled and staff notes, asserting the handler's transaction
+// scrubs both. Kept sequential (no t.Parallel) because the handler reads the
+// process-global payments.SquareClient.
+func TestDeleteAccount_Scrubs2FAAndNotes(t *testing.T) {
+	ctx, tx := testutils.SetupTestTx(t)
+
+	userID, err := fixtures.CreateTestUser(tx)
+	if err != nil {
+		t.Fatalf("failed to create test user: %v", err)
+	}
+
+	_, err = tx.Exec(ctx, `
+		UPDATE users SET
+			notes = 'Staff note with PII',
+			two_factor_enabled = TRUE,
+			two_factor_method = 'sms',
+			two_factor_pending_code_hash = 'deadbeef',
+			two_factor_pending_code_expires = NOW() + INTERVAL '10 minutes'
+		WHERE id = $1
+	`, userID)
+	if err != nil {
+		t.Fatalf("failed to set user notes + 2FA: %v", err)
+	}
+
+	req := httptest.NewRequest(http.MethodDelete, "/api/user/account", nil)
+	req = req.WithContext(context.WithValue(ctx, mw.UserIDKey, userID))
+	rr := httptest.NewRecorder()
+	DeleteAccountHandler(rr, req)
+
+	if rr.Code != http.StatusNoContent {
+		t.Fatalf("expected 204, got %d. body: %s", rr.Code, rr.Body.String())
+	}
+
+	var notes interface{}
+	var enabled bool
+	var method, pendingHash, pendingExpires interface{}
+	err = tx.QueryRow(ctx, `
+		SELECT notes, two_factor_enabled, two_factor_method,
+		       two_factor_pending_code_hash, two_factor_pending_code_expires
+		FROM users WHERE id = $1
+	`, userID).Scan(&notes, &enabled, &method, &pendingHash, &pendingExpires)
+	if err != nil {
+		t.Fatalf("failed to query user after deletion: %v", err)
+	}
+	if notes != nil {
+		t.Errorf("expected users.notes to be NULL after deletion, got %v", notes)
+	}
+	if enabled {
+		t.Error("expected two_factor_enabled to be FALSE after deletion")
+	}
+	if method != nil {
+		t.Errorf("expected two_factor_method to be NULL after deletion, got %v", method)
+	}
+	if pendingHash != nil {
+		t.Errorf("expected two_factor_pending_code_hash to be NULL after deletion, got %v", pendingHash)
+	}
+	if pendingExpires != nil {
+		t.Errorf("expected two_factor_pending_code_expires to be NULL after deletion, got %v", pendingExpires)
 	}
 }