fix(loyalty): fix runtime bugs in storefront routes, point expiration, and enforce settings

- Add total_points_voided column to LoyaltyCard with migration (loyalty_002)
- Fix storefront self_enroll to use correct service method signature and schema fields
- Fix get_my_card/get_my_transactions to use get_card_by_customer_and_merchant
- Fix transaction history field reference (balance_after -> points_balance_after)
- Fix point_expiration task: wrong field names and manual balance update -> card.expire_points()
- Register storefront_router in definition.py and export all routers from __init__.py
- Enforce MerchantLoyaltySettings in storefront enrollment, points, and stamp void operations
- Fix test fixture using non-existent balance_after column
- Suppress intentional architecture validator warnings in templates

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/loyalty/services/points_service.py

@@ -17,6 +17,7 @@ Handles points operations including:
 import logging
 from datetime import UTC, datetime
 
+from fastapi import HTTPException
 from sqlalchemy.orm import Session
 
 from app.modules.loyalty.exceptions import (
@@ -94,6 +95,12 @@ class PointsService:
             logger.warning(f"Points attempted on stamps-only program {program.id}")
             raise LoyaltyCardInactiveException(card.id)
 
+        # Check if order reference is required
+        from app.modules.loyalty.services.program_service import program_service
+        settings = program_service.get_merchant_settings(db, card.merchant_id)
+        if settings and settings.require_order_reference and not order_reference:
+            raise HTTPException(400, "Order reference required")
+
         # Check minimum purchase amount
         if program.minimum_purchase_cents > 0 and purchase_amount_cents < program.minimum_purchase_cents:
             return {
@@ -353,6 +360,12 @@ class PointsService:
 
         program = card.program
 
+        # Check if void transactions are allowed
+        from app.modules.loyalty.services.program_service import program_service
+        settings = program_service.get_merchant_settings(db, card.merchant_id)
+        if settings and not settings.allow_void_transactions:
+            raise LoyaltyCardInactiveException(card.id)
+
         # Verify staff PIN if required
         verified_pin = None
         if program.require_staff_pin:

app/modules/loyalty/services/stamp_service.py

@@ -337,6 +337,12 @@ class StampService:
 
         program = card.program
 
+        # Check if void transactions are allowed
+        from app.modules.loyalty.services.program_service import program_service
+        settings = program_service.get_merchant_settings(db, card.merchant_id)
+        if settings and not settings.allow_void_transactions:
+            raise LoyaltyCardInactiveException(card.id)
+
         # Verify staff PIN if required
         verified_pin = None
         if program.require_staff_pin: