feat(loyalty): production readiness round 2 — 12 security, integrity & correctness fixes

Security:
- Fix TOCTOU race conditions: move balance/limit checks after row lock in redeem_points, add_stamp, redeem_stamps
- Add PIN ownership verification to update/delete/unlock store routes
- Gate adjust_points endpoint to merchant_owner role only

Data integrity:
- Track total_points_voided in void_points
- Add order_reference idempotency guard in earn_points

Correctness:
- Fix LoyaltyProgramAlreadyExistsException to use merchant_id parameter
- Add StorefrontProgramResponse excluding wallet IDs from public API
- Add bounds (±100000) to PointsAdjustRequest.points_delta

Audit & config:
- Add CARD_REACTIVATED transaction type with audit record
- Improve admin audit logging with actor identity and old values
- Use merchant-specific PIN lockout settings with global fallback
- Guard MerchantLoyaltySettings creation with get_or_create pattern

Tests: 27 new tests (265 total) covering all 12 items — unit and integration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/loyalty/tests/unit/test_program_service.py

@@ -236,6 +236,38 @@ class TestCreateProgram:
         settings = self.service.get_merchant_settings(db, ps_merchant.id)
         assert settings is not None
 
+    def test_create_program_with_existing_settings_no_error(self, db, ps_merchant):
+        """Creating a program when MerchantLoyaltySettings already exists succeeds (Item 12)."""
+        from app.modules.loyalty.models import MerchantLoyaltySettings
+
+        # Pre-create settings
+        settings = MerchantLoyaltySettings(merchant_id=ps_merchant.id)
+        db.add(settings)
+        db.commit()
+
+        # Should not raise IntegrityError
+        data = ProgramCreate(loyalty_type="points")
+        program = self.service.create_program(db, ps_merchant.id, data)
+        assert program is not None
+
+        # Should still have exactly one settings row
+        count = (
+            db.query(MerchantLoyaltySettings)
+            .filter(MerchantLoyaltySettings.merchant_id == ps_merchant.id)
+            .count()
+        )
+        assert count == 1
+
+    def test_duplicate_program_exception_uses_merchant_id(self, db, ps_program, ps_merchant):
+        """LoyaltyProgramAlreadyExistsException message references merchant, not store (Item 6)."""
+        data = ProgramCreate(loyalty_type="points")
+        with pytest.raises(LoyaltyProgramAlreadyExistsException) as exc_info:
+            self.service.create_program(db, ps_merchant.id, data)
+
+        assert "Merchant" in str(exc_info.value.message)
+        assert str(ps_merchant.id) in str(exc_info.value.message)
+        assert exc_info.value.details["merchant_id"] == ps_merchant.id
+
 
 # ============================================================================
 # Update Operations