feat(android-terminal): Phase C — PIN screen with offline bcrypt verify

Two-pane landscape: scrollable staff list on the left, PIN dots + numeric
keypad on the right. Footer shows online/offline + pending-sync count.

Going with cached-hashes for offline-capable PIN verify (decision logged
in chat). The threat model already accepts the device — a stolen tablet
holds a 1-year store-scoped JWT, so leaking 4-digit bcrypt hashes is
incremental. Hashes only ever leave the server when the requester is a
paired POS tablet, gated by the new endpoint refusing user JWTs.

Backend:
- GET /api/v1/store/loyalty/pins/for-device — returns PINs WITH pin_hash
  for terminal-device JWTs only; user JWTs receive 403.
- PinForDeviceResponse / PinForDeviceListResponse schemas.
- 2 integration tests in TestPinsForDevice (10/10 pass total).

Android:
- PinForDeviceItem / PinForDeviceListResponse Moshi models.
- LoyaltyApi.listPinsForDevice().
- StaffPinRepository.verifyPin(plain) — at.favre.lib bcrypt verify
  against cached hashes; filters active + unlocked rows in one pass.
- PendingTransactionDao.getPendingCount() switched to Flow<Int> so the
  badge auto-updates when transactions sync.
- PinViewModel state machine — loads pins on init, accumulates digits,
  bcrypt-verifies on length >= 4, fires verified/errorMessage. Combines
  pending-sync count + online state into the same StateFlow.
- PinScreen rewrite: avatar-circle staff list, 6-dot PIN display,
  spinner during verify, error label on wrong PIN, status footer.

Open follow-up (intentional, post-launch): tablet doesn't yet report
failed attempts back to the server's lockout counter. Path is clear —
small POST /pins/{id}/record-failed-attempt endpoint plus a call from
attemptVerify's failure branch.

Verified by ./gradlew assembleDebug — clean build.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/modules/loyalty/schemas/__init__.py

@@ -42,6 +42,8 @@ from app.modules.loyalty.schemas.pin import (
     PinCreateForMerchant,
     PinDetailListResponse,
     PinDetailResponse,
+    PinForDeviceListResponse,
+    PinForDeviceResponse,
     PinListResponse,
     PinResponse,
     PinUpdate,
@@ -135,6 +137,8 @@ __all__ = [
     "PinCreateForMerchant",
     "PinUpdate",
     "PinResponse",
+    "PinForDeviceResponse",
+    "PinForDeviceListResponse",
     "PinDetailResponse",
     "PinListResponse",
     "PinDetailListResponse",

app/modules/loyalty/schemas/pin.py

@@ -99,6 +99,23 @@ class PinDetailListResponse(BaseModel):
     total: int
 
 
+class PinForDeviceResponse(PinResponse):
+    """Pin response for a paired terminal device.
+
+    Includes the bcrypt ``pin_hash`` so the tablet can verify a typed
+    PIN locally without a network round-trip. This shape is ONLY served
+    by the device-only endpoint (``GET /pins/for-device``) — every other
+    pin endpoint stays hash-less.
+    """
+
+    pin_hash: str
+
+
+class PinForDeviceListResponse(BaseModel):
+    pins: list[PinForDeviceResponse]
+    total: int
+
+
 class PinVerifyRequest(BaseModel):
     """Schema for verifying a staff PIN."""