feat(loyalty): production readiness round 2 — 12 security, integrity & correctness fixes

Security:
- Fix TOCTOU race conditions: move balance/limit checks after row lock in redeem_points, add_stamp, redeem_stamps
- Add PIN ownership verification to update/delete/unlock store routes
- Gate adjust_points endpoint to merchant_owner role only

Data integrity:
- Track total_points_voided in void_points
- Add order_reference idempotency guard in earn_points

Correctness:
- Fix LoyaltyProgramAlreadyExistsException to use merchant_id parameter
- Add StorefrontProgramResponse excluding wallet IDs from public API
- Add bounds (±100000) to PointsAdjustRequest.points_delta

Audit & config:
- Add CARD_REACTIVATED transaction type with audit record
- Improve admin audit logging with actor identity and old values
- Use merchant-specific PIN lockout settings with global fallback
- Guard MerchantLoyaltySettings creation with get_or_create pattern

Tests: 27 new tests (265 total) covering all 12 items — unit and integration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/loyalty/tests/unit/test_card_service.py

@@ -290,3 +290,44 @@ class TestGetStoreTransactions:
         )
         assert total >= 3
         assert len(transactions) == 2
+
+
+# ============================================================================
+# Item 9: Reactivate card creates audit transaction
+# ============================================================================
+
+
+@pytest.mark.unit
+@pytest.mark.loyalty
+class TestReactivateCardAudit:
+    """Tests for reactivate_card creating CARD_REACTIVATED transaction."""
+
+    def setup_method(self):
+        self.service = CardService()
+
+    def test_reactivate_creates_transaction(self, db, test_loyalty_card):
+        """Reactivating a card creates a CARD_REACTIVATED transaction."""
+        # Deactivate first
+        test_loyalty_card.is_active = False
+        db.commit()
+
+        self.service.reactivate_card(db, test_loyalty_card.id)
+
+        tx = (
+            db.query(LoyaltyTransaction)
+            .filter(
+                LoyaltyTransaction.card_id == test_loyalty_card.id,
+                LoyaltyTransaction.transaction_type == TransactionType.CARD_REACTIVATED.value,
+            )
+            .first()
+        )
+        assert tx is not None
+        assert tx.merchant_id == test_loyalty_card.merchant_id
+
+    def test_reactivate_sets_card_active(self, db, test_loyalty_card):
+        """Reactivating a card sets is_active to True."""
+        test_loyalty_card.is_active = False
+        db.commit()
+
+        card = self.service.reactivate_card(db, test_loyalty_card.id)
+        assert card.is_active is True