feat(loyalty): attribute transactions to the acting POS tablet

Adds acting_terminal_device_id to loyalty_transactions so the audit
log can distinguish between operations performed via the web terminal
(human user JWT) and operations performed via a paired tablet (device
JWT). The principal-of-record stays the pairing user — existing
reports keep working — and this column adds "which tablet did it"
alongside.

Threaded through every store-API endpoint that creates a transaction
(stamp add/redeem/void, points earn/redeem/void/adjust, enrollment +
welcome bonus, card deactivate/reactivate). The route reads
current_user.terminal_device_id, which the bearer-auth dep populates
when a device JWT is presented. User-token requests leave the column
NULL, as covered by the new test.

Bulk admin operations (GDPR anonymization, bulk deactivate) and Celery
tasks (point expiration) are not threaded — they always come from a
human admin or the scheduler, never a tablet.

- Migration loyalty_011 + LoyaltyTransaction.acting_terminal_device_id
- 9 service signatures gain the optional kwarg
- 8 store-API routes pass it through
- Integration tests: device JWT populates the column, user JWT leaves
  it NULL

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/modules/loyalty/models/loyalty_transaction.py

@@ -105,6 +105,16 @@ class LoyaltyTransaction(Base, TimestampMixin):
         index=True,
         comment="Staff PIN used for this operation",
     )
+    acting_terminal_device_id = Column(
+        Integer,
+        ForeignKey("loyalty_terminal_devices.id", ondelete="SET NULL"),
+        nullable=True,
+        index=True,
+        comment=(
+            "Paired POS terminal device that performed this transaction "
+            "(NULL when the action came from a human user via the web)"
+        ),
+    )
     category_ids = Column(
         JSON,
         nullable=True,
@@ -220,6 +230,10 @@ class LoyaltyTransaction(Base, TimestampMixin):
     card = relationship("LoyaltyCard", back_populates="transactions")
     store = relationship("Store", backref="loyalty_transactions")
     staff_pin = relationship("StaffPin", backref="transactions")
+    acting_terminal_device = relationship(
+        "TerminalDevice",
+        backref="transactions",
+    )
     related_transaction = relationship(
         "LoyaltyTransaction",
         remote_side=[id],