Add audited KYC and AML review workflow

[TaprootFreak]

What

• add an audited Compliance transition that sets a UserData KYC status to Check
• add a guarded BuyCrypto AML review-reset endpoint that returns eligible incomplete transactions to Pending
• require KYC Check, the expected AML snapshot, and an eligible current BuyCrypto state
• record the authenticated staff actor and immutable before/after audit data atomically
• expose one authoritative server-side reset blocker to the Compliance frontend
• harden batching, payout, stop, refund, return, forward, and liquidity races with state-checked writes and row locks
• make Checkout, crypto-input, and bank refunds durable and transactionally claimed before external work
• reconcile asynchronous Checkout refunds by stable reference, amount, provider action, idempotency key, cooldown, and attempt cap
• preserve compatibility with already-started unreferenced Checkout refunds

Why

Compliance operators need a safe frontend workflow to return a user to KYC review and then re-run AML for a blocked BuyCrypto transaction without browser developer tools.

Safety

• completed, stopped, batched, refunded, returned, forwarded, or payout-started transactions cannot be reactivated
• refund source rows are locked and re-read before state changes
• provider responses cannot regress a persisted Checkout refund state
• Checkout actions are correlated by a deterministic card-network-safe reference and exact amount
• failed Checkout refunds use a six-hour cooldown, stop after three matching attempts, and require manual intervention
• stale or concurrent mutations fail closed
• audit failure rolls back the KYC or AML transition
• no production data was mutated during development or verification

Verification

• full Jest suite: 359 suites and 6,820 tests passed (8 suites / 202 tests skipped)
• focused workflow suite: 6 suites and 128 tests passed
• TypeScript type-check, ESLint, Prettier, and diff checks passed
• two independent final review passes on the exact final API commit and frontend diff: 0 findings
• all new commits are validly signed

Related

• frontend: Add KYC Check and AML reset workflow services#1236

[TaprootFreak]

Final review completed: two independent review passes with 0 remaining findings. Verification includes 6 focused suites with 116 tests, 2 support/transaction suites with 29 tests, type-check, lint, migration validation, and all required GitHub checks. No production data was mutated during development or verification.

[github-actions]

❌ TypeScript: 8 errors

[TaprootFreak]

Final two-lens review reached 0 merge-blocking and 0 non-blocking findings after 10 review rounds. The final head passed every required GitHub check; the review bot reports TSC_ERRORS: 0 and ESLINT_ERRORS: 0, and every PR commit has a valid GitHub signature.

[TaprootFreak]

Final verification on exact head ee4d4e7443d05ec5ce840cad4f679a61001cb4b1: two independent final review passes reported 0 findings. Local verification passed with TypeScript, ESLint, Prettier, 6 focused suites / 128 tests, and the full 359-suite / 6,820-test run. All 13 GitHub checks are green, and the final commit is validly signed. No production data was mutated and this PR was not merged.