fix: add GET /cards/lookup endpoint for loyalty terminal customer search

The terminal JS uses GET with a free-text ?q= parameter, but only a POST
endpoint existed with typed params (card_id, qr_code, card_number).

- Add search_card_for_store service method (tries card number then email)
- Add GET /cards/lookup route using the service method
- Extract _build_card_lookup_response helper to DRY up POST and GET endpoints

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/loyalty/services/card_service.py

@@ -255,6 +255,50 @@ class CardService:
             merchant_id=store.merchant_id,
         )
 
+    def search_card_for_store(
+        self,
+        db: Session,
+        store_id: int,
+        query: str,
+    ) -> LoyaltyCard | None:
+        """
+        Search for a card by free-text query (card number or customer email).
+
+        Args:
+            db: Database session
+            store_id: Store ID (to scope merchant and customer lookup)
+            query: Search string — card number or customer email
+
+        Returns:
+            Found card or None
+        """
+        from app.modules.customers.models import Customer
+        from app.modules.tenancy.models import Store
+
+        store = db.query(Store).filter(Store.id == store_id).first()
+        if not store:
+            return None
+
+        merchant_id = store.merchant_id
+
+        # Try card number
+        card = self.get_card_by_number(db, query)
+        if card and card.merchant_id == merchant_id:
+            return card
+
+        # Try customer email
+        customer = (
+            db.query(Customer)
+            .filter(Customer.email == query, Customer.store_id == store_id)
+            .first()
+        )
+        if customer:
+            card = self.get_card_by_customer_and_merchant(db, customer.id, merchant_id)
+            if card:
+                return card
+
+        return None
+
     def list_cards(
         self,
         db: Session,