[Almondsf]

• Cancelling a booking paid online refunds what was prepaid beyond the fee straight to the card, from that booking's bill only (one room of a group never refunds the others). A gateway failure leaves the credit on the folio for staff and is audited; the cancellation still stands. The guest's manage-booking page says how much is coming back
• Search results give each rate's free-cancellation deadline for the dates (or that it has passed / the rate is non-refundable), and checkout warns before payment
• A refresh cookie presented twice within 30 seconds (quick double reload, or a navigation that cut off the first response) gets the same rotated tokens instead of a sign-out, unless the session has since ended. API clients keep strictly single-use tokens. Cache is configurable via CACHE_URL for multi-process deployments
• Tests always use placeholder gateway keys, whatever a developer's .env holds, so they can never reach a real account
• Docs: system overview, user stories, deployment, .env.example