fix(loyalty): add GET /merchants/{merchant_id}/program to admin API

The shared JS modules (cards-list, pins-list, transactions-list) all
call {apiPrefix}/program to load the program before fetching data. For
admin on-behalf pages, this resolved to GET /admin/loyalty/merchants/
{id}/program which only had a POST endpoint, causing 405 Method Not
Allowed errors on all admin on-behalf pages.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

app/modules/loyalty/routes/api/admin.py

@@ -120,6 +120,23 @@ def get_program_stats(
     return ProgramStatsResponse(**stats)
 
 
+@router.get("/merchants/{merchant_id}/program", response_model=ProgramResponse)
+def get_merchant_program(
+    merchant_id: int = Path(..., gt=0),
+    current_user: User = Depends(get_current_admin_api),
+    db: Session = Depends(get_db),
+):
+    """Get a merchant's loyalty program (on behalf)."""
+    program = program_service.require_program_by_merchant(db, merchant_id)
+
+    response = ProgramResponse.model_validate(program)
+    response.is_stamps_enabled = program.is_stamps_enabled
+    response.is_points_enabled = program.is_points_enabled
+    response.display_name = program.display_name
+
+    return response
+
+
 @router.post(
     "/merchants/{merchant_id}/program", response_model=ProgramResponse, status_code=201
 )