feat(loyalty): production readiness round 2 — 12 security, integrity & correctness fixes

Security:
- Fix TOCTOU race conditions: move balance/limit checks after row lock in redeem_points, add_stamp, redeem_stamps
- Add PIN ownership verification to update/delete/unlock store routes
- Gate adjust_points endpoint to merchant_owner role only

Data integrity:
- Track total_points_voided in void_points
- Add order_reference idempotency guard in earn_points

Correctness:
- Fix LoyaltyProgramAlreadyExistsException to use merchant_id parameter
- Add StorefrontProgramResponse excluding wallet IDs from public API
- Add bounds (±100000) to PointsAdjustRequest.points_delta

Audit & config:
- Add CARD_REACTIVATED transaction type with audit record
- Improve admin audit logging with actor identity and old values
- Use merchant-specific PIN lockout settings with global fallback
- Guard MerchantLoyaltySettings creation with get_or_create pattern

Tests: 27 new tests (265 total) covering all 12 items — unit and integration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/loyalty/services/pin_service.py

@@ -293,19 +293,35 @@ class PinService:
 
         # No match found - record failed attempt on the first unlocked PIN only
         # This limits blast radius to 1 lockout instead of N
+
+        # Use merchant-specific settings if available, fall back to global config
+        max_attempts = config.pin_max_failed_attempts
+        lockout_minutes = config.pin_lockout_minutes
+        if pins:
+            from app.modules.loyalty.models import LoyaltyProgram
+            program = db.query(LoyaltyProgram).filter(LoyaltyProgram.id == program_id).first()
+            if program:
+                from app.modules.loyalty.services.program_service import (
+                    program_service as _ps,
+                )
+                merchant_settings = _ps.get_merchant_settings(db, program.merchant_id)
+                if merchant_settings:
+                    max_attempts = merchant_settings.staff_pin_lockout_attempts
+                    lockout_minutes = merchant_settings.staff_pin_lockout_minutes
+
         locked_pin = None
         remaining = None
 
         for pin in pins:
             if not pin.is_locked:
                 is_now_locked = pin.record_failed_attempt(
-                    max_attempts=config.pin_max_failed_attempts,
-                    lockout_minutes=config.pin_lockout_minutes,
+                    max_attempts=max_attempts,
+                    lockout_minutes=lockout_minutes,
                 )
                 if is_now_locked:
                     locked_pin = pin
                 else:
-                    remaining = max(0, config.pin_max_failed_attempts - pin.failed_attempts)
+                    remaining = max(0, max_attempts - pin.failed_attempts)
                 break  # Only record on the first unlocked PIN
 
         db.commit()