Gift-card refunds now preserve remaining value

Gift-card sales now open their own transaction detail instead of an unrelated payment page. Venue owners and Finance staff can review the original purchase, still-unredeemed amount, pending reservations, and refund history together before issuing a full or partial refund. Every request requires a fresh two-factor-authenticated session, a reason, an idempotent operation identity, and the full gift-card code typed as confirmation. The gift sender is not presented as the verified payer because the stored gift message does not prove cardholder identity or payment method.

While a refund is processing, the matching gift-card value is reserved and cannot be redeemed or voided. Confirmed processor refunds update the cash ledger and stored value exactly once. Destination-transfer recovery runs as a separate leased, idempotent operation after customer settlement; a scheduled worker resumes expired leases and required owner/Finance notifications. Late or conflicting provider events cannot regress terminal state. If a succeeded refund is later canceled, stored value is restored only from its immutable pre-state, while an in-flight or completed venue recovery opens manual venue-funds restoration review instead of moving money automatically.

Deployment requires database migration `20261019000706_gift_card_cash_refund_convergence.sql` before the application release. The generated database types and migration manifest must include the new provenance, lifecycle/outbox/recovery tables, reservation and recovery columns, and RPCs in the same release. Existing gift cards without immutable processor and original-transfer provenance remain visible but fail closed for original-payment refunds until Finance reviews them.