fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

Loop B aggressive adversarial round (3 attack agents) + fix + secondary + verification:
- CRITICAL: sweep replay auto-refunds provably-created-later duplicate charges (gated on parseable CreatedAt); 22h legitimate-retry window == 22h sweep cutoff (no dead zone)
- HIGH: admin Take Payment clamps to remaining obligation (cash/giftcard/saved-card/terminal); no unintended tip from overflow; campaign credit against remaining
- HIGH: /api/services/eligible-for/{id} requires auth + owner-or-admin (DOB/age + patch-test health-data leak closed)
- HIGH: opaque refresh-token rotation (login/refresh return {token, jti, refreshToken}; refresh REQUIRES opaque token; single-use rotation; logout revokes; access token rejected at refresh)
- HIGH: saved-card charges require a REAL 2FA verification code (B6/B10) — backend gate on all 8 charge paths + shared TwoFactorCodeInput frontend component on all 7 surfaces; 2FA gate is no longer setup-flag-only
- MEDIUM: ungated CF-Connecting-IP in reserve/admin_reserve gated via exported mw.ClientIP; 2FA limiter keyed on userID alone (no header-rotation bypass); ChangePassword actually revokes JTI + refresh tokens; 2FA setup mint cooldown + persistent failed-attempt counter; campaign redemption race surfaces campaign_fully_redeemed
- Terminal saved-card VAT applied (was under-collected); age-guard reconcile failures notify; isWeakJWTSecret entropy gate; gift-card redeem per-card counter + per-user limiter; webhook signature key startup validation
- NEW internal/twofa package (single source of truth breaking the payments<->user import cycle); consolidation of duplicate 2FA hash/verify
- Frontend: refresh-token storage + rotation, TwoFactorCodeInput component, amountPaidPence in admin modal, B5/B6/B10 contract wiring; 70 frontend tests
- Tests: loop_b_fixes_test.go, internal/twofa tests, updated auth/services/profile/twofa/mw tests

All 26 backend packages pass (incl. internal/twofa); frontend 70/70 + build clean; env-docs 41/41.

backend/main_test.go

@@ -6,6 +6,7 @@ import (
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 
 	"crussell/db"
@@ -262,3 +263,30 @@ func TestIsWeakJWTSecret_CaseAndWhitespaceInsensitive(t *testing.T) {
 		t.Errorf("expected a whitespace-padded strong secret to be accepted")
 	}
 }
+
+// ============================================================
+// isWeakJWTSecret entropy gate (B15)
+// ============================================================
+
+// TestIsWeakJWTSecret_EntropyGate verifies the B15 fix: secrets that clear the
+// length and blacklist checks but lack entropy are rejected. An all-same-char
+// and an all-zero 32+ char secret each have a 1-byte alphabet — trivially
+// brute-forceable despite meeting the length requirement — while a strong
+// random secret with many distinct bytes is accepted.
+func TestIsWeakJWTSecret_EntropyGate(t *testing.T) {
+	weak := []string{
+		strings.Repeat("a", 32),            // all-same-char: 1 distinct byte
+		strings.Repeat("0", 32),            // all-zero: 1 distinct byte
+		strings.Repeat("ab", 16),           // 2 distinct bytes
+		strings.Repeat("abcd", 8),          // 4 distinct bytes
+		"abcdefghijklmnopqrstuvwxyz123456", // many distinct, strong — accepted
+	}
+	for i := 0; i < len(weak)-1; i++ {
+		if !isWeakJWTSecret(weak[i]) {
+			t.Errorf("expected low-entropy secret %q to be rejected", weak[i])
+		}
+	}
+	if isWeakJWTSecret(weak[len(weak)-1]) {
+		t.Errorf("expected high-entropy secret %q to be accepted", weak[len(weak)-1])
+	}
+}