feat(loyalty): add dedicated program edit page with full CRUD and tests

Add /admin/loyalty/merchants/{id}/program route for program configuration
with a dedicated Alpine.js edit page supporting create/edit/delete flows.
Restructure programs dashboard with create modal (merchant search +
duplicate detection) and delete confirmation. Rename "Loyalty Settings"
to "Admin Policy" for clearer separation of concerns.

Add integration tests for all admin page routes (12 tests) and program
list search/filter/pagination endpoints (9 tests).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/modules/loyalty/tests/integration/test_admin_api.py

@@ -383,3 +383,152 @@ class TestAdminExistingEndpoints:
             headers=super_admin_headers,
         )
         assert response.status_code == 200
+
+
+# ============================================================================
+# LIST PROGRAMS — Search & Filters
+# ============================================================================
+
+
+@pytest.mark.integration
+@pytest.mark.api
+@pytest.mark.loyalty
+class TestAdminListProgramsSearch:
+    """Tests for GET /api/v1/admin/loyalty/programs search and filter params."""
+
+    def test_search_by_merchant_name(
+        self, client, super_admin_headers, admin_program, admin_merchant
+    ):
+        """Search query filters programs by merchant name."""
+        # Use a substring of the merchant name
+        search_term = admin_merchant.name[:10]
+        response = client.get(
+            f"{BASE}/programs",
+            params={"search": search_term},
+            headers=super_admin_headers,
+        )
+        assert response.status_code == 200
+        data = response.json()
+        assert data["total"] >= 1
+        # Our program should be in results
+        program_ids = [p["id"] for p in data["programs"]]
+        assert admin_program.id in program_ids
+
+    def test_search_no_results(
+        self, client, super_admin_headers, admin_program
+    ):
+        """Search with non-matching term returns empty."""
+        response = client.get(
+            f"{BASE}/programs",
+            params={"search": "zzz_no_such_merchant_999"},
+            headers=super_admin_headers,
+        )
+        assert response.status_code == 200
+        data = response.json()
+        assert data["total"] == 0
+        assert data["programs"] == []
+
+    def test_search_case_insensitive(
+        self, client, super_admin_headers, admin_program, admin_merchant
+    ):
+        """Search is case-insensitive (ilike)."""
+        search_term = admin_merchant.name.upper()
+        response = client.get(
+            f"{BASE}/programs",
+            params={"search": search_term},
+            headers=super_admin_headers,
+        )
+        assert response.status_code == 200
+        data = response.json()
+        assert data["total"] >= 1
+
+    def test_filter_by_active_status(
+        self, client, super_admin_headers, admin_program
+    ):
+        """is_active filter returns only matching programs."""
+        response = client.get(
+            f"{BASE}/programs",
+            params={"is_active": True},
+            headers=super_admin_headers,
+        )
+        assert response.status_code == 200
+        data = response.json()
+        # All returned programs should be active
+        for p in data["programs"]:
+            assert p["is_active"] is True
+
+    def test_filter_inactive_excludes_active(
+        self, client, super_admin_headers, admin_program
+    ):
+        """is_active=false excludes active programs."""
+        response = client.get(
+            f"{BASE}/programs",
+            params={"is_active": False},
+            headers=super_admin_headers,
+        )
+        assert response.status_code == 200
+        data = response.json()
+        # admin_program is active, should NOT be in results
+        program_ids = [p["id"] for p in data["programs"]]
+        assert admin_program.id not in program_ids
+
+    def test_pagination_skip_limit(
+        self, client, super_admin_headers, admin_program
+    ):
+        """Pagination params control results."""
+        response = client.get(
+            f"{BASE}/programs",
+            params={"skip": 0, "limit": 1},
+            headers=super_admin_headers,
+        )
+        assert response.status_code == 200
+        data = response.json()
+        assert len(data["programs"]) <= 1
+
+    def test_search_combined_with_active_filter(
+        self, client, super_admin_headers, admin_program, admin_merchant
+    ):
+        """Search and is_active filter work together."""
+        search_term = admin_merchant.name[:10]
+        response = client.get(
+            f"{BASE}/programs",
+            params={"search": search_term, "is_active": True},
+            headers=super_admin_headers,
+        )
+        assert response.status_code == 200
+        data = response.json()
+        assert data["total"] >= 1
+        for p in data["programs"]:
+            assert p["is_active"] is True
+
+    def test_list_programs_requires_auth(self, client):
+        """Unauthenticated request is rejected."""
+        response = client.get(f"{BASE}/programs")
+        assert response.status_code == 401
+
+
+# ============================================================================
+# CREATE — Duplicate Prevention
+# ============================================================================
+
+
+@pytest.mark.integration
+@pytest.mark.api
+@pytest.mark.loyalty
+class TestAdminCreateProgramDuplicate:
+    """Tests for duplicate program creation prevention."""
+
+    def test_create_duplicate_program_rejected(
+        self, client, super_admin_headers, admin_program, admin_merchant
+    ):
+        """Cannot create a second program for a merchant that already has one."""
+        response = client.post(
+            f"{BASE}/merchants/{admin_merchant.id}/program",
+            json={
+                "loyalty_type": "stamps",
+                "stamps_target": 8,
+            },
+            headers=super_admin_headers,
+        )
+        # Should fail — merchant already has admin_program
+        assert response.status_code in [409, 422]