fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

Loop B aggressive adversarial round (3 attack agents) + fix + secondary + verification:
- CRITICAL: sweep replay auto-refunds provably-created-later duplicate charges (gated on parseable CreatedAt); 22h legitimate-retry window == 22h sweep cutoff (no dead zone)
- HIGH: admin Take Payment clamps to remaining obligation (cash/giftcard/saved-card/terminal); no unintended tip from overflow; campaign credit against remaining
- HIGH: /api/services/eligible-for/{id} requires auth + owner-or-admin (DOB/age + patch-test health-data leak closed)
- HIGH: opaque refresh-token rotation (login/refresh return {token, jti, refreshToken}; refresh REQUIRES opaque token; single-use rotation; logout revokes; access token rejected at refresh)
- HIGH: saved-card charges require a REAL 2FA verification code (B6/B10) — backend gate on all 8 charge paths + shared TwoFactorCodeInput frontend component on all 7 surfaces; 2FA gate is no longer setup-flag-only
- MEDIUM: ungated CF-Connecting-IP in reserve/admin_reserve gated via exported mw.ClientIP; 2FA limiter keyed on userID alone (no header-rotation bypass); ChangePassword actually revokes JTI + refresh tokens; 2FA setup mint cooldown + persistent failed-attempt counter; campaign redemption race surfaces campaign_fully_redeemed
- Terminal saved-card VAT applied (was under-collected); age-guard reconcile failures notify; isWeakJWTSecret entropy gate; gift-card redeem per-card counter + per-user limiter; webhook signature key startup validation
- NEW internal/twofa package (single source of truth breaking the payments<->user import cycle); consolidation of duplicate 2FA hash/verify
- Frontend: refresh-token storage + rotation, TwoFactorCodeInput component, amountPaidPence in admin modal, B5/B6/B10 contract wiring; 70 frontend tests
- Tests: loop_b_fixes_test.go, internal/twofa tests, updated auth/services/profile/twofa/mw tests

All 26 backend packages pass (incl. internal/twofa); frontend 70/70 + build clean; env-docs 41/41.

backend/handlers/user/twofa_prod.go

@@ -24,6 +24,7 @@ package user
 // operator explicitly opted into log delivery and accepted its risk.
 
 import (
+	"crussell/internal/twofa"
 	"errors"
 	"log"
 	"os"
@@ -48,12 +49,12 @@ const twoFAAllowLogDeliveryEnv = "TWO_FACTOR_ALLOW_LOG_DELIVERY"
 // brute-force offline.
 var errTwoFAPepperRequired = errors.New("TWO_FACTOR_PEPPER is not set; refusing to issue a 2FA code (an unsalted digest would be offline-brute-forceable)")
 
-// twoFAPepper returns the configured HMAC pepper, or "" when unset. Production
-// builds do NOT warn or fall back to the legacy digest: code issuance fails
-// closed via twoFAEnsureIssueAllowed, so no pending code is ever persisted as
-// an unsalted SHA-256 digest.
-func twoFAPepper() string {
-	return os.Getenv(twoFAPepperEnv)
+// init registers the production pepper reader into the shared verification
+// core (crussell/internal/twofa): raw env read, no fallback — code issuance
+// fails closed via twoFAEnsureIssueAllowed, so no pending code is ever
+// persisted as an unsalted SHA-256 digest.
+func init() {
+	twofa.SetPepperProvider(func() string { return os.Getenv(twoFAPepperEnv) })
 }
 
 // twoFADeliveryAvailable reports whether a 2FA code delivery channel exists in