feat(booth): disable card tender until a P2PE POS is on-site (cash-only)

No card processor / POS terminal on any site yet. Offering "Card" would let an
operator record a card payment that never cleared a terminal, corrupting the
till reconciliation — a fraud/error surface on an operator-adversary system.

Add apps/web/src/lib/features.ts → CARD_PAYMENTS_ENABLED=false, gating both
tender pickers (BoothPayModal, SubscriptionManager). With card off there's
nothing to choose, so the tender row is suppressed and payment defaults to
cash. UI-only gate: the Tender type, payment events, shift accounting, and
reports still understand `card`, so historical card events and a future
re-enable stay coherent.

Verified via Playwright: an unpaid-ticket modal shows Total + "Pay + open
barrier" with no tender/cash/card row.

Wiki: new concepts/card-payments.md records the current cash-only state, the
PCI-scope-out-of-app constraint, the future-POS device requirements, and the
re-enable path (flip the flag once a bank-certified P2PE terminal is
provisioned). Linked from index, parking-session, open-questions #3.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/web/src/lib/features.ts

@@ -0,0 +1,16 @@
+// Client-side feature flags. Small, hand-flipped switches for capabilities the app
+// SUPPORTS in code but that aren't provisioned on-site yet — so the UI doesn't offer an
+// action the site can't fulfil.
+
+/**
+ * CARD payments. The app models a `card` tender end-to-end (server, shift accounting,
+ * reports), but a card sale needs a bank-certified **P2PE POS terminal** on-site, and we
+ * have NONE yet (2026-07-01). Until one is procured + configured, the booth/subscription
+ * tender pickers show CASH only — offering "Card" would let an operator record a card
+ * payment that never actually cleared a terminal, corrupting the till reconciliation.
+ *
+ * Flip to `true` (and add the POS device config) once a terminal is on-site. Nothing about
+ * the `Tender` type or historical `card` events changes — this only gates the UI *offer*.
+ * See wiki/concepts/card-payments.md (future POS device requirements).
+ */
+export const CARD_PAYMENTS_ENABLED = false;