Security recovery: hold sweep, dashboard updates, and admin fixes.

frontend/src/app/(public)/dashboard/components/_shared/helpers.ts

@@ -6,6 +6,16 @@ import { formatPrice, parseDate, EVENT_TIMEZONE } from '@/lib/utils';
 // ticket was created, capped at the event start time.
 export const PAYMENT_HOLD_HOURS = 24;
 
+// Hours a pending-approval booking (payment already marked as sent) can wait
+// for admin review before the auto-hold sweep releases the spot. Mirrors the
+// backend's HOLD_THRESHOLD_HOURS env default - keep these in sync.
+export const HOLD_THRESHOLD_HOURS = 72;
+
+/** True once a booking has been auto-released after the approval hold window. */
+export function isOnHold(ticket: Pick<UserTicket, 'status'> & { payment?: { status?: string } | null }): boolean {
+  return ticket.status === 'on_hold' || ticket.payment?.status === 'on_hold';
+}
+
 /** Currency is Guarani with no decimals, e.g. "21 PYG". */
 export function pyg(amount: number, currency: string = 'PYG'): string {
   return formatPrice(Number(amount) || 0, currency || 'PYG');