feat(android-terminal): Phase C — PIN screen with offline bcrypt verify

Two-pane landscape: scrollable staff list on the left, PIN dots + numeric
keypad on the right. Footer shows online/offline + pending-sync count.

Going with cached-hashes for offline-capable PIN verify (decision logged
in chat). The threat model already accepts the device — a stolen tablet
holds a 1-year store-scoped JWT, so leaking 4-digit bcrypt hashes is
incremental. Hashes only ever leave the server when the requester is a
paired POS tablet, gated by the new endpoint refusing user JWTs.

Backend:
- GET /api/v1/store/loyalty/pins/for-device — returns PINs WITH pin_hash
  for terminal-device JWTs only; user JWTs receive 403.
- PinForDeviceResponse / PinForDeviceListResponse schemas.
- 2 integration tests in TestPinsForDevice (10/10 pass total).

Android:
- PinForDeviceItem / PinForDeviceListResponse Moshi models.
- LoyaltyApi.listPinsForDevice().
- StaffPinRepository.verifyPin(plain) — at.favre.lib bcrypt verify
  against cached hashes; filters active + unlocked rows in one pass.
- PendingTransactionDao.getPendingCount() switched to Flow<Int> so the
  badge auto-updates when transactions sync.
- PinViewModel state machine — loads pins on init, accumulates digits,
  bcrypt-verifies on length >= 4, fires verified/errorMessage. Combines
  pending-sync count + online state into the same StateFlow.
- PinScreen rewrite: avatar-circle staff list, 6-dot PIN display,
  spinner during verify, error label on wrong PIN, status footer.

Open follow-up (intentional, post-launch): tablet doesn't yet report
failed attempts back to the server's lockout counter. Path is clear —
small POST /pins/{id}/record-failed-attempt endpoint plus a call from
attemptVerify's failure branch.

Verified by ./gradlew assembleDebug — clean build.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/modules/loyalty/routes/api/store.py

@@ -30,6 +30,8 @@ from app.modules.loyalty.schemas import (
     CardResponse,
     MerchantStatsResponse,
     PinCreate,
+    PinForDeviceListResponse,
+    PinForDeviceResponse,
     PinListResponse,
     PinResponse,
     PinUpdate,
@@ -346,6 +348,47 @@ def list_pins(
     )
 
 
+@router.get("/pins/for-device", response_model=PinForDeviceListResponse)
+def list_pins_for_device(
+    current_user: User = Depends(get_current_store_api),
+    db: Session = Depends(get_db),
+):
+    """List staff PINs *with* their bcrypt ``pin_hash`` for offline verify.
+
+    Reserved for paired POS tablets — the ``Authorization`` header must
+    carry a device JWT. User JWTs are rejected with 403. Hashes only ever
+    leave the server when the requester has been blessed by a merchant
+    owner via the device pairing flow, and the device is the same source
+    of truth that can be revoked from /merchants/loyalty/devices.
+    """
+    if current_user.terminal_device_id is None:
+        raise AuthorizationException(
+            "This endpoint is only available to paired POS terminal devices"
+        )
+
+    store_id = current_user.token_store_id
+    program = program_service.require_program_by_store(db, store_id)
+    pins = pin_service.list_pins(db, program.id, store_id=store_id)
+
+    return PinForDeviceListResponse(
+        pins=[
+            PinForDeviceResponse(
+                id=p.id,
+                name=p.name,
+                staff_id=p.staff_id,
+                is_active=p.is_active,
+                is_locked=p.is_locked,
+                locked_until=p.locked_until,
+                last_used_at=p.last_used_at,
+                created_at=p.created_at,
+                pin_hash=p.pin_hash,
+            )
+            for p in pins
+        ],
+        total=len(pins),
+    )
+
+
 @router.post("/pins", response_model=PinResponse, status_code=201)
 def create_pin(
     data: PinCreate,