feat(android-terminal): Phase C — PIN screen with offline bcrypt verify

Two-pane landscape: scrollable staff list on the left, PIN dots + numeric
keypad on the right. Footer shows online/offline + pending-sync count.

Going with cached-hashes for offline-capable PIN verify (decision logged
in chat). The threat model already accepts the device — a stolen tablet
holds a 1-year store-scoped JWT, so leaking 4-digit bcrypt hashes is
incremental. Hashes only ever leave the server when the requester is a
paired POS tablet, gated by the new endpoint refusing user JWTs.

Backend:
- GET /api/v1/store/loyalty/pins/for-device — returns PINs WITH pin_hash
  for terminal-device JWTs only; user JWTs receive 403.
- PinForDeviceResponse / PinForDeviceListResponse schemas.
- 2 integration tests in TestPinsForDevice (10/10 pass total).

Android:
- PinForDeviceItem / PinForDeviceListResponse Moshi models.
- LoyaltyApi.listPinsForDevice().
- StaffPinRepository.verifyPin(plain) — at.favre.lib bcrypt verify
  against cached hashes; filters active + unlocked rows in one pass.
- PendingTransactionDao.getPendingCount() switched to Flow<Int> so the
  badge auto-updates when transactions sync.
- PinViewModel state machine — loads pins on init, accumulates digits,
  bcrypt-verifies on length >= 4, fires verified/errorMessage. Combines
  pending-sync count + online state into the same StateFlow.
- PinScreen rewrite: avatar-circle staff list, 6-dot PIN display,
  spinner during verify, error label on wrong PIN, status footer.

Open follow-up (intentional, post-launch): tablet doesn't yet report
failed attempts back to the server's lockout counter. Path is clear —
small POST /pins/{id}/record-failed-attempt endpoint plus a call from
attemptVerify's failure branch.

Verified by ./gradlew assembleDebug — clean build.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/modules/loyalty/tests/integration/test_terminal_devices.py

@@ -257,3 +257,55 @@ class TestActingDeviceAudit:
         )
         assert tx is not None
         assert tx.acting_terminal_device_id is None
+
+
+@pytest.mark.integration
+@pytest.mark.api
+@pytest.mark.loyalty
+class TestPinsForDevice:
+    """GET /pins/for-device exposes hashes only to paired devices."""
+
+    def test_device_token_receives_hashes(
+        self, client, loyalty_merchant_headers, loyalty_store_setup, db
+    ):
+        from app.modules.loyalty.models import StaffPin
+
+        store = loyalty_store_setup["store"]
+        program = loyalty_store_setup["program"]
+        pin = StaffPin(
+            merchant_id=store.merchant_id,
+            program_id=program.id,
+            store_id=store.id,
+            name="Test Cashier",
+            staff_id="cash01",
+        )
+        pin.set_pin("4321")
+        db.add(pin)
+        db.commit()
+        db.refresh(pin)
+
+        paired = client.post(
+            f"{MERCHANT_BASE}/devices",
+            json={"store_id": store.id, "label": "PIN test"},
+            headers=loyalty_merchant_headers,
+        ).json()
+        token = paired["setup_token"]
+
+        response = client.get(
+            f"{STORE_BASE}/pins/for-device",
+            headers={"Authorization": f"Bearer {token}"},
+        )
+        assert response.status_code == 200, response.text
+        payload = response.json()
+        assert payload["total"] >= 1
+        target = next(p for p in payload["pins"] if p["id"] == pin.id)
+        assert target["pin_hash"].startswith("$2") and len(target["pin_hash"]) > 50
+
+    def test_user_token_is_rejected(
+        self, client, loyalty_store_headers
+    ):
+        response = client.get(
+            f"{STORE_BASE}/pins/for-device",
+            headers=loyalty_store_headers,
+        )
+        assert response.status_code == 403, response.text