feat(loyalty): Phase 1 production launch hardening

Phase 1 of the loyalty production launch plan: config & security
hardening, dropped-data fix, DB integrity guards, rate limiting, and
constant-time auth compare. 362 tests pass.

- 1.4 Persist customer birth_date (new column + migration). Enrollment
  form was collecting it but the value was silently dropped because
  create_customer_for_enrollment never received it. Backfills existing
  customers without overwriting.
- 1.1 LOYALTY_GOOGLE_SERVICE_ACCOUNT_JSON validated at startup (file
  must exist and be readable; ~ expanded). Adds is_google_wallet_enabled
  and is_apple_wallet_enabled derived flags. Prod path documented as
  ~/apps/orion/google-wallet-sa.json.
- 1.5 CHECK constraints on loyalty_cards (points_balance, stamp_count
  non-negative) and loyalty_programs (min_purchase, points_per_euro,
  welcome_bonus non-negative; stamps_target >= 1). Mirrored as
  CheckConstraint in models. Pre-flight scan showed zero violations.
- 1.3 @rate_limit on store mutating endpoints: stamp 60/min,
  redeem/points-earn 30-60/min, void/adjust 20/min, pin unlock 10/min.
- 1.2 Constant-time hmac.compare_digest for Apple Wallet auth token
  (pulled forward from Phase 9 — code is safe whenever Apple ships).

See app/modules/loyalty/docs/production-launch-plan.md for the full
launch plan and remaining phases.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

app/modules/loyalty/tests/integration/test_store_api.py

@@ -463,6 +463,34 @@ class TestStampEarnRedeem:
         assert data["success"] is True
         assert data["stamp_count"] == 0
 
+    def test_stamp_endpoint_is_rate_limited(
+        self, client, stamp_store_headers, stamp_store_setup
+    ):
+        """POST /stamp returns 429 once the per-IP cap is exceeded."""
+        from middleware.decorators import rate_limiter
+
+        # Reset the in-memory limiter so prior tests don't bleed in
+        rate_limiter.clients.clear()
+
+        card = stamp_store_setup["card"]
+        # Cap is 60 per minute. Hit it 60 times and expect any 200/4xx but not
+        # a 429, then the 61st should be 429.
+        for _ in range(60):
+            client.post(
+                f"{BASE}/stamp",
+                json={"card_id": card.id},
+                headers=stamp_store_headers,
+            )
+
+        response = client.post(
+            f"{BASE}/stamp",
+            json={"card_id": card.id},
+            headers=stamp_store_headers,
+        )
+        assert response.status_code == 429
+
+        rate_limiter.clients.clear()
+
 
 # ============================================================================
 # Item 2: PIN Ownership Checks