fix: review-loop B — adversarial findings (sweep auto-refund, admin clamp, 2FA real challenge, opaque refresh tokens, gated client IP, GBP pence)

Loop B aggressive adversarial round (3 attack agents) + fix + secondary + verification:
- CRITICAL: sweep replay auto-refunds provably-created-later duplicate charges (gated on parseable CreatedAt); 22h legitimate-retry window == 22h sweep cutoff (no dead zone)
- HIGH: admin Take Payment clamps to remaining obligation (cash/giftcard/saved-card/terminal); no unintended tip from overflow; campaign credit against remaining
- HIGH: /api/services/eligible-for/{id} requires auth + owner-or-admin (DOB/age + patch-test health-data leak closed)
- HIGH: opaque refresh-token rotation (login/refresh return {token, jti, refreshToken}; refresh REQUIRES opaque token; single-use rotation; logout revokes; access token rejected at refresh)
- HIGH: saved-card charges require a REAL 2FA verification code (B6/B10) — backend gate on all 8 charge paths + shared TwoFactorCodeInput frontend component on all 7 surfaces; 2FA gate is no longer setup-flag-only
- MEDIUM: ungated CF-Connecting-IP in reserve/admin_reserve gated via exported mw.ClientIP; 2FA limiter keyed on userID alone (no header-rotation bypass); ChangePassword actually revokes JTI + refresh tokens; 2FA setup mint cooldown + persistent failed-attempt counter; campaign redemption race surfaces campaign_fully_redeemed
- Terminal saved-card VAT applied (was under-collected); age-guard reconcile failures notify; isWeakJWTSecret entropy gate; gift-card redeem per-card counter + per-user limiter; webhook signature key startup validation
- NEW internal/twofa package (single source of truth breaking the payments<->user import cycle); consolidation of duplicate 2FA hash/verify
- Frontend: refresh-token storage + rotation, TwoFactorCodeInput component, amountPaidPence in admin modal, B5/B6/B10 contract wiring; 70 frontend tests
- Tests: loop_b_fixes_test.go, internal/twofa tests, updated auth/services/profile/twofa/mw tests

All 26 backend packages pass (incl. internal/twofa); frontend 70/70 + build clean; env-docs 41/41.

frontend/src/lib/square/square.test.ts

@@ -9,6 +9,8 @@ import {
 	isNonceStale,
 	isOverflowTipConfirmationRequired,
 	isSavedCardVerificationRequired,
+	isTwoFactorVerificationGateFailure,
+	requires2FACodeForSavedCard,
 	sanitizeDecimalInput,
 	submitPaymentWithRetry
 } from './square';
@@ -217,6 +219,52 @@ describe('payment failure classification', () => {
 	});
 });
 
+describe('requires2FACodeForSavedCard', () => {
+	it('is true when the session user has twoFactorRequired set', () => {
+		expect(requires2FACodeForSavedCard({ twoFactorRequired: true })).toBe(true);
+	});
+
+	it('is false when twoFactorRequired is unset or false', () => {
+		expect(requires2FACodeForSavedCard({ twoFactorRequired: false })).toBe(false);
+		expect(requires2FACodeForSavedCard({})).toBe(false);
+	});
+
+	it('is false for a null/undefined session user', () => {
+		expect(requires2FACodeForSavedCard(null)).toBe(false);
+		expect(requires2FACodeForSavedCard(undefined)).toBe(false);
+	});
+
+	it('does not depend on the 2FA setup flag (B6/B10: the code is required per charge)', () => {
+		expect(requires2FACodeForSavedCard({ twoFactorRequired: true, twoFactorEnabled: true })).toBe(
+			true
+		);
+		expect(requires2FACodeForSavedCard({ twoFactorRequired: true, twoFactorEnabled: false })).toBe(
+			true
+		);
+	});
+});
+
+describe('isTwoFactorVerificationGateFailure', () => {
+	it.each([
+		[403, 'A two-factor verification code is required to use this saved card', true],
+		[403, 'Two-factor authentication is required to use online card payments', true],
+		[429, 'Too many attempts', true],
+		[400, 'Invalid verification code', true],
+		[400, 'Verification code expired — request a new one', true],
+		[400, 'Booking must be in_progress or completed to create payment', false],
+		[400, 'Invalid request', false],
+		[402, 'Payment failed', false],
+		[200, '', false],
+		[500, 'internal server error', false]
+	])('status %d + message "%s" → %s', (status, message, expected) => {
+		expect(isTwoFactorVerificationGateFailure(status, message)).toBe(expected);
+	});
+
+	it('treats any 403 as a gate failure on a saved-card charge (missing code / 2FA not enabled)', () => {
+		expect(isTwoFactorVerificationGateFailure(403, 'something else')).toBe(true);
+	});
+});
+
 describe('isOverflowTipConfirmationRequired', () => {
 	it('matches the backend overflow-guard error body by its code', () => {
 		const body = JSON.stringify({