fix(loyalty): accept store_id in body for merchant PIN create

The merchant /pins POST was reading store_id as a query parameter, but
the shared loyalty pins JS factory sends the form (including store_id)
as a JSON body — matching the store-side endpoint, which gets store_id
from the JWT and ignores any body field. Result: a 422 "Field
required" on every PIN create from /merchants/loyalty/pins.

Add PinCreateForMerchant (PinCreate + store_id) and switch the
endpoint to it. Validation that the store belongs to the merchant is
unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/modules/loyalty/schemas/__init__.py

@@ -39,6 +39,7 @@ from app.modules.loyalty.schemas.card import (
 from app.modules.loyalty.schemas.pin import (
     # Staff PIN
     PinCreate,
+    PinCreateForMerchant,
     PinDetailListResponse,
     PinDetailResponse,
     PinListResponse,
@@ -131,6 +132,7 @@ __all__ = [
     "PointsAdjustResponse",
     # PIN
     "PinCreate",
+    "PinCreateForMerchant",
     "PinUpdate",
     "PinResponse",
     "PinDetailResponse",