feat(loyalty): Phase 1 production launch hardening

Phase 1 of the loyalty production launch plan: config & security
hardening, dropped-data fix, DB integrity guards, rate limiting, and
constant-time auth compare. 362 tests pass.

- 1.4 Persist customer birth_date (new column + migration). Enrollment
  form was collecting it but the value was silently dropped because
  create_customer_for_enrollment never received it. Backfills existing
  customers without overwriting.
- 1.1 LOYALTY_GOOGLE_SERVICE_ACCOUNT_JSON validated at startup (file
  must exist and be readable; ~ expanded). Adds is_google_wallet_enabled
  and is_apple_wallet_enabled derived flags. Prod path documented as
  ~/apps/orion/google-wallet-sa.json.
- 1.5 CHECK constraints on loyalty_cards (points_balance, stamp_count
  non-negative) and loyalty_programs (min_purchase, points_per_euro,
  welcome_bonus non-negative; stamps_target >= 1). Mirrored as
  CheckConstraint in models. Pre-flight scan showed zero violations.
- 1.3 @rate_limit on store mutating endpoints: stamp 60/min,
  redeem/points-earn 30-60/min, void/adjust 20/min, pin unlock 10/min.
- 1.2 Constant-time hmac.compare_digest for Apple Wallet auth token
  (pulled forward from Phase 9 — code is safe whenever Apple ships).

See app/modules/loyalty/docs/production-launch-plan.md for the full
launch plan and remaining phases.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

app/modules/loyalty/services/card_service.py

@@ -14,7 +14,7 @@ Handles card operations including:
 """
 
 import logging
-from datetime import UTC, datetime
+from datetime import UTC, date, datetime
 
 from sqlalchemy.orm import Session, joinedload
 
@@ -169,7 +169,7 @@ class CardService:
         create_if_missing: bool = False,
         customer_name: str | None = None,
         customer_phone: str | None = None,
-        customer_birthday: str | None = None,
+        customer_birthday: date | None = None,
     ) -> int:
         """
         Resolve a customer ID from either a direct ID or email lookup.
@@ -183,7 +183,7 @@ class CardService:
                 (used for self-enrollment)
             customer_name: Full name for customer creation
             customer_phone: Phone for customer creation
-            customer_birthday: Birthday (YYYY-MM-DD) for customer creation
+            customer_birthday: Date of birth for customer creation
 
         Returns:
             Resolved customer ID
@@ -202,6 +202,12 @@ class CardService:
 
             customer = customer_service.get_customer_by_email(db, store_id, email)
             if customer:
+                # Backfill birthday on existing customer if they didn't have
+                # one before — keeps the enrollment form useful for returning
+                # customers who never previously provided a birthday.
+                if customer_birthday and not customer.birth_date:
+                    customer.birth_date = customer_birthday
+                    db.flush()
                 return customer.id
 
             if create_if_missing:
@@ -220,6 +226,7 @@ class CardService:
                     first_name=first_name,
                     last_name=last_name,
                     phone=customer_phone,
+                    birth_date=customer_birthday,
                 )
                 logger.info(
                     f"Created customer {customer.id} ({email}) "