feat(loyalty): Google Wallet production readiness — 10 hardening items

- Fix rate limiter to extract real client IP and handle sync/async endpoints
- Rate-limit public enrollment (10/min) and program info (30/min) endpoints
- Add 409 Conflict to non-retryable status codes in retry decorator
- Cache private key in get_save_url() to avoid re-reading JSON per call
- Make update_class() return bool success status with error-level logging
- Move Google Wallet config from core to loyalty module config
- Document time.sleep() safety in retry decorator (threadpool execution)
- Add per-card retry (1 retry, 2s delay) to wallet sync task
- Add logo URL reachability check (HEAD request) to validate_config()
- Add 26 comprehensive unit tests for GoogleWalletService

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/core/config.py

@@ -217,14 +217,6 @@ class Settings(BaseSettings):
     # =============================================================================
     cloudflare_enabled: bool = False  # Set to True when using CloudFlare proxy
 
-    # =============================================================================
-    # GOOGLE WALLET (LOYALTY MODULE)
-    # =============================================================================
-    loyalty_google_issuer_id: str | None = None
-    loyalty_google_service_account_json: str | None = None  # Path to service account JSON
-    loyalty_google_wallet_origins: list[str] = []  # Allowed origins for save-to-wallet JWT
-    loyalty_default_logo_url: str = "https://rewardflow.lu/static/modules/loyalty/shared/img/default-logo-200.png"
-
     # =============================================================================
     # APPLE WALLET (LOYALTY MODULE)
     # =============================================================================
@@ -234,7 +226,7 @@ class Settings(BaseSettings):
     loyalty_apple_signer_cert_path: str | None = None
     loyalty_apple_signer_key_path: str | None = None
 
-    model_config = {"env_file": ".env"}
+    model_config = {"env_file": ".env", "extra": "ignore"}
 
 
 # Singleton settings instance