feat(loyalty): production readiness round 2 — 12 security, integrity & correctness fixes

Security:
- Fix TOCTOU race conditions: move balance/limit checks after row lock in redeem_points, add_stamp, redeem_stamps
- Add PIN ownership verification to update/delete/unlock store routes
- Gate adjust_points endpoint to merchant_owner role only

Data integrity:
- Track total_points_voided in void_points
- Add order_reference idempotency guard in earn_points

Correctness:
- Fix LoyaltyProgramAlreadyExistsException to use merchant_id parameter
- Add StorefrontProgramResponse excluding wallet IDs from public API
- Add bounds (±100000) to PointsAdjustRequest.points_delta

Audit & config:
- Add CARD_REACTIVATED transaction type with audit record
- Improve admin audit logging with actor identity and old values
- Use merchant-specific PIN lockout settings with global fallback
- Guard MerchantLoyaltySettings creation with get_or_create pattern

Tests: 27 new tests (265 total) covering all 12 items — unit and integration.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/loyalty/tests/unit/test_stamp_service.py

@@ -285,3 +285,69 @@ class TestVoidStamps:
 
         assert void_result["success"] is True
         assert void_result["stamp_count"] == 0
+
+
+# ============================================================================
+# Item 1: TOCTOU Race Condition (stamp checks after lock)
+# ============================================================================
+
+
+@pytest.mark.unit
+@pytest.mark.loyalty
+class TestStampTOCTOU:
+    """Verify cooldown/daily-limit checks happen after row lock."""
+
+    def setup_method(self):
+        self.service = StampService()
+
+    def test_cooldown_checked_after_lock(self, db, stamp_setup):
+        """Cooldown check uses locked row state."""
+        card = stamp_setup["card"]
+        store = stamp_setup["store"]
+        program = stamp_setup["program"]
+
+        # Enable cooldown
+        program.cooldown_minutes = 60
+        db.commit()
+
+        # First stamp succeeds
+        self.service.add_stamp(db, store_id=store.id, card_id=card.id)
+
+        # Second stamp should fail (cooldown active after lock)
+        with pytest.raises(StampCooldownException):
+            self.service.add_stamp(db, store_id=store.id, card_id=card.id)
+
+    def test_daily_limit_checked_after_lock(self, db, stamp_setup):
+        """Daily limit check uses locked row state."""
+        card = stamp_setup["card"]
+        store = stamp_setup["store"]
+        program = stamp_setup["program"]
+
+        program.max_daily_stamps = 1
+        db.commit()
+
+        # First stamp succeeds
+        self.service.add_stamp(db, store_id=store.id, card_id=card.id)
+
+        # Second stamp should fail (daily limit after lock)
+        with pytest.raises(DailyStampLimitException):
+            self.service.add_stamp(db, store_id=store.id, card_id=card.id)
+
+    def test_redeem_stamps_insufficient_after_lock(self, db, stamp_setup):
+        """Stamp count check uses locked row state."""
+        card = stamp_setup["card"]
+        store = stamp_setup["store"]
+        program = stamp_setup["program"]
+
+        # Give exact stamp target
+        card.stamp_count = program.stamps_target
+        card.total_stamps_earned = program.stamps_target
+        db.commit()
+
+        # First redeem succeeds
+        result = self.service.redeem_stamps(db, store_id=store.id, card_id=card.id)
+        assert result["success"] is True
+
+        # Second redeem should fail (0 stamps after lock)
+        with pytest.raises(InsufficientStampsException):
+            self.service.redeem_stamps(db, store_id=store.id, card_id=card.id)