fix(loyalty): replace broad exception handlers with specific types and rename onboarding service

- Replace `except Exception` with specific exception types in
  google_wallet_service.py (requests.RequestException, ValueError, etc.)
  and apple_wallet_service.py (httpx.HTTPError, OSError, ssl.SSLError)
- Rename loyalty_onboarding.py -> loyalty_onboarding_service.py to
  match NAM-002 naming convention (+ test file + imports)
- Add PasswordChangeResponse Pydantic model to user_account API,
  removing raw dict return and noqa suppression

Resolves 12 EXC-003 + 1 NAM-002 architecture warnings in loyalty module.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/loyalty/services/apple_wallet_service.py

@@ -417,9 +417,9 @@ class AppleWalletService:
         size = 29 * scale
 
         if program.logo_url:
-            try:
-                import httpx
+            import httpx
 
+            try:
                 resp = httpx.get(program.logo_url, timeout=10, follow_redirects=True)
                 resp.raise_for_status()
                 img = Image.open(io.BytesIO(resp.content))
@@ -428,7 +428,7 @@ class AppleWalletService:
                 buf = io.BytesIO()
                 img.save(buf, format="PNG")
                 return buf.getvalue()
-            except Exception:
+            except (httpx.HTTPError, OSError, ValueError):
                 logger.warning("Failed to fetch logo for icon, using fallback")
 
         # Fallback: colored square with initial
@@ -463,9 +463,9 @@ class AppleWalletService:
         width, height = 160 * scale, 50 * scale
 
         if program.logo_url:
-            try:
-                import httpx
+            import httpx
 
+            try:
                 resp = httpx.get(program.logo_url, timeout=10, follow_redirects=True)
                 resp.raise_for_status()
                 img = Image.open(io.BytesIO(resp.content))
@@ -480,7 +480,7 @@ class AppleWalletService:
                 buf = io.BytesIO()
                 canvas.save(buf, format="PNG")
                 return buf.getvalue()
-            except Exception:
+            except (httpx.HTTPError, OSError, ValueError):
                 logger.warning("Failed to fetch logo for pass logo, using fallback")
 
         # Fallback: colored rectangle with initial
@@ -719,7 +719,7 @@ class AppleWalletService:
                         response.status_code,
                         response.text,
                     )
-        except Exception as exc:  # noqa: BLE001
+        except (httpx.HTTPError, ssl.SSLError, OSError) as exc:
             logger.error("APNs push error for token %s...: %s", push_token[:8], exc)