fix: review-loop hardening — identical-body replay, 2FA gates, webhook at-least-once, GDPR scrub

Follow-up to the comprehensive payment-system review. Fixes the issues the
review found in the initial integration, plus the rough edges it introduced.

Money-safety:
- Replay-by-key now replays the FULL original request verbatim from a stored
  square_request_snapshot, so a retained idempotency key returns the original
  payment instead of IDEMPOTENCY_KEY_REUSED (previously the row sat pending
  forever). IDEMPOTENCY_KEY_REUSED remains ambiguous (never proof of no charge).
- Dev mock mirrors real Square for unknown-key replays: ccof: saved-card
  sources are charged and rescued; spent cnon: nonces surface
  ErrReplayKeyNotRetained. (Fixes dev/prod parity divergence.)
- Webhook dedup row committed AFTER dispatch (at-least-once); FAILED till sales
  claw back gift-card funding; event-type strings match Square's real catalog.
- Expired-gift-card cancellation refunds set creditFailed (never a phantom
  'completed' refund); cancellation refunds lock all payment rows ascending.
- Sweep never rescue-completes a gift-card purchase without delivering the card.
- Tip no-client-key fallback is a deterministic count-based key under the
  booking advisory lock (retry-safe, distinct tips don't collapse).
- M-cap subtracts completed refunds, clamped to [0, total].

2FA (PSD2 SCA stand-in) for online saved-card payments:
- Full feature: status/setup/verify/disable endpoints, gating helper wired into
  all 7 saved-card charge paths (incl. BuyGiftCard + admin saved-card), account
  admin-tab settings UI, frontend gating across all payment surfaces.
- Enforcement is FAIL-CLOSED: on unless REQUIRE_2FA=false or an explicit
  mock/dev SQUARE_ENVIRONMENT; startup warning when off in a non-dev env.
- Verify is brute-force hardened (5-attempt lockout, timing-safe compare);
  plaintext codes only logged when enforcement is off (dev).
- GDPR: anonymize_user also scrubs 2FA columns and staff notes.

Infra/docs:
- nginx: /api/ response cache removed (cross-user disclosure); port 80
  redirects to HTTPS (localhost/RFC1918 exempt, end-anchored regexes); HSTS;
  separate webhook rate-limit zone.
- Schema: users 2FA columns; payments/till_sales square_source_id +
  square_request_snapshot.
- Legal docs: gift-card cooling-off, international-transfers section, tips
  policy; Gap Backlog P3 webhooks marked done; stale counts/wording corrected.
- Flaky test race fixed (t.Parallel + global mock mutation); suite 26/26
  packages green, 2,142 tests, svelte-check clean.

frontend/src/lib/components/payments/PaymentModal.svelte

@@ -7,7 +7,9 @@
 	import { Checkbox } from '$lib/components/ui/checkbox';
 	import type { Booking, BookingService, BookingDiscount } from '$lib/types/booking';
 	import { apiFetch } from '$lib/utils/api';
-import { submitPaymentWithRetry } from '$lib/square/square';
+	import { submitPaymentWithRetry } from '$lib/square/square';
+	import { authStore } from '$lib/stores/auth.svelte';
+	import { resolve } from '$app/paths';
 
 	const LOYALTY_DISCOUNT_RATE = 0.1;
 
@@ -54,6 +56,13 @@ import { submitPaymentWithRetry } from '$lib/square/square';
 	// reactive flag is checked synchronously at the start of every handler.
 	let isProcessingPaymentSync = false;
 
+	// PSD2 SCA stand-in: 2FA required but not enabled blocks charging a
+	// customer's saved card online (the admin's own 2FA status gates it). The
+	// card-machine and new-card paths have their own SCA.
+	const twoFactorBlocksSavedCards = $derived(
+		!!authStore.currentUser?.twoFactorRequired && !authStore.currentUser?.twoFactorEnabled
+	);
+
 	const stamps = $derived(booking.user?.loyalty_stamps ?? 0);
 	let useLoyalty = $state(false);
 
@@ -661,6 +670,10 @@ import { submitPaymentWithRetry } from '$lib/square/square';
 
 	async function handleSavedCardPayment() {
 		if (isProcessingPaymentSync) return;
+		if (twoFactorBlocksSavedCards) {
+			toast.error('Two-factor authentication is required to use online card payments');
+			return;
+		}
 		if (!selectedSavedCardId) {
 			toast.error('Please select a saved card');
 			return;
@@ -744,6 +757,13 @@ import { submitPaymentWithRetry } from '$lib/square/square';
 	}
 
 	$effect(() => {
+		// PSD2 SCA stand-in: if 2FA gating becomes active mid-modal, bail out
+		// of the saved-card screen back to method selection.
+		if (selectedMethod === 'savedcard' && twoFactorBlocksSavedCards) {
+			selectedMethod = null;
+			status = 'idle';
+			return;
+		}
 		if (selectedMethod === 'cash') {
 			cashAmount = totalDue.toFixed(2);
 			extraAsTip = false;
@@ -952,7 +972,7 @@ import { submitPaymentWithRetry } from '$lib/square/square';
 						</svg>
 						Cash
 					</button>
-					{#if savedCardList.length > 0}
+					{#if savedCardList.length > 0 && !twoFactorBlocksSavedCards}
 						<button
 							type="button"
 							disabled={nothingToCharge}
@@ -1008,8 +1028,17 @@ import { submitPaymentWithRetry } from '$lib/square/square';
 					</button>
 				</div>
 
+				{#if twoFactorBlocksSavedCards && savedCardList.length > 0}
+					<div class="rounded-md border border-amber-200 bg-amber-50 p-3">
+						<p class="text-sm text-amber-800">
+							Two-factor authentication is required to use online card payments.
+							<a href={resolve('/account')} class="font-medium underline">Enable it in your account settings</a>.
+						</p>
+					</div>
+				{/if}
+
 				<div class="flex flex-wrap gap-3 sm:hidden">
-					{#if savedCardList.length > 0}
+					{#if savedCardList.length > 0 && !twoFactorBlocksSavedCards}
 						<button
 							type="button"
 							disabled={nothingToCharge}