feat(loyalty): restructure program CRUD by interface

Move program CRUD from store to merchant/admin interfaces.
Store becomes view-only for program config while merchant gets
full CRUD and admin gets override capabilities.

Merchant portal:
- New API endpoints (GET/POST/PATCH/DELETE /program)
- New settings page with create/edit/delete form
- Overview page now has Create/Edit Program buttons
- Settings menu item added to sidebar

Admin portal:
- New CRUD endpoints (create for merchant, update, delete)
- New activate/deactivate program endpoints
- Programs list has edit and toggle buttons per row
- Merchant detail has create/delete/toggle program actions

Store portal:
- Removed POST/PATCH /program endpoints (now read-only)
- Removed settings page route and template
- Terminal, cards, stats, enroll unchanged

Tests: 112 passed (58 new) covering merchant API, admin CRUD,
store endpoint removal, and program service unit tests.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/loyalty/routes/api/admin.py

@@ -20,9 +20,11 @@ from app.modules.loyalty.schemas import (
     MerchantSettingsResponse,
     MerchantSettingsUpdate,
     MerchantStatsResponse,
+    ProgramCreate,
     ProgramListResponse,
     ProgramResponse,
     ProgramStatsResponse,
+    ProgramUpdate,
 )
 from app.modules.loyalty.services import program_service
 from app.modules.tenancy.models import User  # API-007
@@ -107,6 +109,93 @@ def get_program_stats(
     return ProgramStatsResponse(**stats)
 
 
+@admin_router.post(
+    "/merchants/{merchant_id}/program", response_model=ProgramResponse, status_code=201
+)
+def create_program_for_merchant(
+    data: ProgramCreate,
+    merchant_id: int = Path(..., gt=0),
+    current_user: User = Depends(get_current_admin_api),
+    db: Session = Depends(get_db),
+):
+    """Create a loyalty program for a merchant (admin override)."""
+    program = program_service.create_program(db, merchant_id, data)
+
+    response = ProgramResponse.model_validate(program)
+    response.is_stamps_enabled = program.is_stamps_enabled
+    response.is_points_enabled = program.is_points_enabled
+    response.display_name = program.display_name
+
+    logger.info(f"Admin created loyalty program for merchant {merchant_id}")
+    return response
+
+
+@admin_router.patch("/programs/{program_id}", response_model=ProgramResponse)
+def update_program(
+    data: ProgramUpdate,
+    program_id: int = Path(..., gt=0),
+    current_user: User = Depends(get_current_admin_api),
+    db: Session = Depends(get_db),
+):
+    """Update a loyalty program (admin override)."""
+    program = program_service.update_program(db, program_id, data)
+
+    response = ProgramResponse.model_validate(program)
+    response.is_stamps_enabled = program.is_stamps_enabled
+    response.is_points_enabled = program.is_points_enabled
+    response.display_name = program.display_name
+
+    logger.info(f"Admin updated loyalty program {program_id}")
+    return response
+
+
+@admin_router.delete("/programs/{program_id}", status_code=204)
+def delete_program(
+    program_id: int = Path(..., gt=0),
+    current_user: User = Depends(get_current_admin_api),
+    db: Session = Depends(get_db),
+):
+    """Delete a loyalty program (admin override)."""
+    program_service.delete_program(db, program_id)
+    logger.info(f"Admin deleted loyalty program {program_id}")
+
+
+@admin_router.post("/programs/{program_id}/activate", response_model=ProgramResponse)
+def activate_program(
+    program_id: int = Path(..., gt=0),
+    current_user: User = Depends(get_current_admin_api),
+    db: Session = Depends(get_db),
+):
+    """Activate a loyalty program."""
+    program = program_service.activate_program(db, program_id)
+
+    response = ProgramResponse.model_validate(program)
+    response.is_stamps_enabled = program.is_stamps_enabled
+    response.is_points_enabled = program.is_points_enabled
+    response.display_name = program.display_name
+
+    logger.info(f"Admin activated loyalty program {program_id}")
+    return response
+
+
+@admin_router.post("/programs/{program_id}/deactivate", response_model=ProgramResponse)
+def deactivate_program(
+    program_id: int = Path(..., gt=0),
+    current_user: User = Depends(get_current_admin_api),
+    db: Session = Depends(get_db),
+):
+    """Deactivate a loyalty program."""
+    program = program_service.deactivate_program(db, program_id)
+
+    response = ProgramResponse.model_validate(program)
+    response.is_stamps_enabled = program.is_stamps_enabled
+    response.is_points_enabled = program.is_points_enabled
+    response.display_name = program.display_name
+
+    logger.info(f"Admin deactivated loyalty program {program_id}")
+    return response
+
+
 # =============================================================================
 # Merchant Management
 # =============================================================================