fix(loyalty): accept store_id in body for merchant PIN create

The merchant /pins POST was reading store_id as a query parameter, but
the shared loyalty pins JS factory sends the form (including store_id)
as a JSON body — matching the store-side endpoint, which gets store_id
from the JWT and ignores any body field. Result: a 422 "Field
required" on every PIN create from /merchants/loyalty/pins.

Add PinCreateForMerchant (PinCreate + store_id) and switch the
endpoint to it. Validation that the store belongs to the merchant is
unchanged.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/modules/loyalty/schemas/pin.py

@@ -31,6 +31,14 @@ class PinCreate(BaseModel):
     )
 
 
+class PinCreateForMerchant(PinCreate):
+    """PinCreate from the merchant portal — carries the target store_id in
+    the body since the merchant has no per-store auth context (unlike the
+    store-side endpoint which reads store_id from the JWT)."""
+
+    store_id: int = Field(..., gt=0, description="Store this PIN belongs to")
+
+
 class PinUpdate(BaseModel):
     """Schema for updating a staff PIN."""