feat(loyalty): implement complete loyalty module MVP

Add stamp-based and points-based loyalty programs for vendors with:

Database Models (5 tables):
- loyalty_programs: Vendor program configuration
- loyalty_cards: Customer cards with stamp/point balances
- loyalty_transactions: Immutable audit log
- staff_pins: Fraud prevention PINs (bcrypt hashed)
- apple_device_registrations: Apple Wallet push tokens

Services:
- program_service: Program CRUD and statistics
- card_service: Customer enrollment and card lookup
- stamp_service: Stamp operations with anti-fraud checks
- points_service: Points earning and redemption
- pin_service: Staff PIN management with lockout
- wallet_service: Unified wallet abstraction
- google_wallet_service: Google Wallet API integration
- apple_wallet_service: Apple Wallet .pkpass generation

API Routes:
- Admin: /api/v1/admin/loyalty/* (programs list, stats)
- Vendor: /api/v1/vendor/loyalty/* (stamp, points, cards, PINs)
- Public: /api/v1/loyalty/* (enrollment, Apple Web Service)

Anti-Fraud Features:
- Staff PIN verification (configurable per program)
- Cooldown period between stamps (default 15 min)
- Daily stamp limits (default 5/day)
- PIN lockout after failed attempts

Wallet Integration:
- Google Wallet: LoyaltyClass and LoyaltyObject management
- Apple Wallet: .pkpass generation with PKCS#7 signing
- Apple Web Service endpoints for device registration/updates

Also includes:
- Alembic migration for all tables with indexes
- Localization files (en, fr, de, lu)
- Module documentation
- Phase 2 interface and user journey plan

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

app/modules/loyalty/schemas/pin.py

@@ -0,0 +1,98 @@
+# app/modules/loyalty/schemas/pin.py
+"""
+Pydantic schemas for staff PIN operations.
+"""
+
+from datetime import datetime
+
+from pydantic import BaseModel, ConfigDict, Field
+
+
+class PinCreate(BaseModel):
+    """Schema for creating a staff PIN."""
+
+    name: str = Field(
+        ...,
+        min_length=1,
+        max_length=100,
+        description="Staff member name",
+    )
+    staff_id: str | None = Field(
+        None,
+        max_length=50,
+        description="Optional employee ID",
+    )
+    pin: str = Field(
+        ...,
+        min_length=4,
+        max_length=6,
+        pattern="^[0-9]+$",
+        description="4-6 digit PIN",
+    )
+
+
+class PinUpdate(BaseModel):
+    """Schema for updating a staff PIN."""
+
+    model_config = ConfigDict(from_attributes=True)
+
+    name: str | None = Field(
+        None,
+        min_length=1,
+        max_length=100,
+    )
+    staff_id: str | None = Field(
+        None,
+        max_length=50,
+    )
+    pin: str | None = Field(
+        None,
+        min_length=4,
+        max_length=6,
+        pattern="^[0-9]+$",
+        description="New PIN (if changing)",
+    )
+    is_active: bool | None = None
+
+
+class PinResponse(BaseModel):
+    """Schema for staff PIN response (never includes actual PIN)."""
+
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    name: str
+    staff_id: str | None = None
+    is_active: bool
+    is_locked: bool = False
+    locked_until: datetime | None = None
+    last_used_at: datetime | None = None
+    created_at: datetime
+
+
+class PinListResponse(BaseModel):
+    """Schema for listing staff PINs."""
+
+    pins: list[PinResponse]
+    total: int
+
+
+class PinVerifyRequest(BaseModel):
+    """Schema for verifying a staff PIN."""
+
+    pin: str = Field(
+        ...,
+        min_length=4,
+        max_length=6,
+        pattern="^[0-9]+$",
+        description="PIN to verify",
+    )
+
+
+class PinVerifyResponse(BaseModel):
+    """Schema for PIN verification response."""
+
+    valid: bool
+    staff_name: str | None = None
+    remaining_attempts: int | None = None
+    locked_until: datetime | None = None