K1: card purchases on the server (schema 4, Enable Banking adapter, E-36 to E-44)

Contract (SPEC §14.8): migration 0004_card_purchases.sql (server schema 4, byte-identical
contract and server copies), E-36 to E-44 in contracts/openapi.yaml with the four new error
codes and a 502 response, examples for every card body and error code, the
match_card_purchase vectors (17 cases) with their Python reference in tools/contracts-check.py
(157 checks), web/src/api/schema.d.ts regenerated; web/src/lib/vectors.test.ts lists
match_card_purchase as not ported until K3 ports it (orchestrator's allowance).

Server: src/cards/ with the provider registry (CP-1), the CardSource trait and its
Enable Banking adapter (JWT RS256 kid = application id, /aspsps, /auth, /sessions,
transactions with PSU headers for user-present fetches, CP-14 error mapping, CP-7 mapping),
the windowed fetch (30-day windows newest first, split at the 100-row cap down to a day,
de-duplication by provider_ref, continuation keys, WRONG_TRANSACTIONS_PERIOD ends the walk),
CP-8 matching with the secondary rule, the background poller (06:45, 11:45, 16:45, 21:45,
4 per 24 hours, 2-hour skip, no backlog), the bilingual callback page (E-39), E-36 to E-38
and E-40 to E-44, link clearing in sync push step 7, attempt pruning at 04:00, the card_fetch
log line with aggregates only, KVITT_EB_* configuration. Tests against a local stub
(tests/cards_api/, 34 tests); the real API is never called.

Infra: Pi compose mounts secrets/cards read-only and passes the two application ids;
.env.example keys; dev stack stages infra/secrets/cards/; NPM block with the /cards/callback
gate line and unlogged location (kvitt.conf and README step 4); README "Card purchases".

Pre-commit hook bypassed (--no-verify, orchestrator's decision): the Android fast tests fail
in :domain VectorFilesTest (and the full check in :data ExampleRoundTripTest) because they pin
the contract's vector and example sets; matchCardPurchase and the card DTOs are K2's by design
(contract-first landing; K2 lands next). Server, contracts-check and web gates are green.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

infra/dev/.env.example

@@ -16,6 +16,12 @@ KVITT_PUBLIC_URL=
 # Firebase project for FCM HTTP v1 (SPEC §10.4, §10.7).
 KVITT_FCM_PROJECT_ID=kvitt-1337
 
+# Enable Banking application ids for card purchases (SPEC §10.4, D-175). Empty: card features off. The keys are
+# ${KVITT_SECRETS_DIR}/cards/enable-banking.pem (and enable-banking-member.pem), staged by up.sh. The application's
+# registered redirect is the Pi's https address, so the real BankID flow cannot complete against this stack.
+KVITT_EB_APP_ID=
+KVITT_EB_MEMBER_APP_ID=
+
 # tracing filter (SPEC §10.4).
 RUST_LOG=info
 

infra/dev/compose.yaml

@@ -41,12 +41,17 @@ services:
       KVITT_PUBLIC_URL: ${KVITT_PUBLIC_URL:-http://localhost:8080}
       KVITT_FCM_CREDENTIALS: /secrets/fcm-service-account.json
       KVITT_FCM_PROJECT_ID: ${KVITT_FCM_PROJECT_ID:-kvitt-1337}
+      # Card purchases (SPEC §10.4, D-175): empty = card features off. up.sh stages the keys of
+      # ${KVITT_SECRETS_DIR}/cards/ into infra/dev/secrets/cards/, read by the KVITT_EB_KEY_FILE defaults.
+      KVITT_EB_APP_ID: ${KVITT_EB_APP_ID:-}
+      KVITT_EB_MEMBER_APP_ID: ${KVITT_EB_MEMBER_APP_ID:-}
       RUST_LOG: ${RUST_LOG:-info}
     volumes:
       # SQLite database, pictures and APKs: a bind-mounted folder on the Mac (git-ignored).
       - ${KVITT_DEV_DATA_DIR:-./data}:/data
-      # Only the FCM key, read-only (D-117): up.sh copies ${KVITT_SECRETS_DIR}/fcm-service-account.json into
-      # infra/dev/secrets/ (git-ignored), which holds nothing else. A folder is mounted rather than the file, because
+      # Only the FCM key and the card keys, read-only (D-117, D-175): up.sh copies
+      # ${KVITT_SECRETS_DIR}/fcm-service-account.json and ${KVITT_SECRETS_DIR}/cards/ into infra/dev/secrets/
+      # (git-ignored), which holds nothing else. A folder is mounted rather than the file, because
       # a missing source file would make Docker create a directory in its place, while a missing key must simply
       # leave push disabled with a start-up warning (§10.4); without the key the folder is empty.
       - ./secrets:/secrets:ro

infra/dev/lib.sh

@@ -36,14 +36,14 @@ lan_address() {
   [[ -n "$iface" ]] && ipconfig getifaddr "$iface" 2>/dev/null
 }
 
-# Fill infra/dev/secrets/ (git-ignored, mounted read-only at /secrets) with only the FCM key from
-# KVITT_SECRETS_DIR, so the server container sees no other secret (D-117). Without the key the folder is left
-# empty and the server starts with push disabled (§10.4).
+# Fill infra/dev/secrets/ (git-ignored, mounted read-only at /secrets) with only the FCM key and the card keys
+# folder from KVITT_SECRETS_DIR, so the server container sees no other secret (D-117, D-175). Without the FCM key
+# the server starts with push disabled (§10.4); see stage_card_keys for the card keys.
 stage_fcm_key() {
   local src stage="$dev_dir/secrets"
   src="$(dev_path "$(env_value KVITT_SECRETS_DIR ../secrets)")/fcm-service-account.json"
   install -d -m 0700 "$stage"
-  find "$stage" -mindepth 1 -maxdepth 1 ! -name fcm-service-account.json -exec rm -rf {} +
+  find "$stage" -mindepth 1 -maxdepth 1 ! -name fcm-service-account.json ! -name cards -exec rm -rf {} +
   if [[ -f "$src" ]]; then
     install -m 0600 "$src" "$stage/fcm-service-account.json"
   else
@@ -51,3 +51,20 @@ stage_fcm_key() {
     echo "$(basename "$0"): no $src; the server starts with push disabled." >&2
   fi
 }
+
+# Copy the Enable Banking keys of KVITT_SECRETS_DIR/cards/ (only *.pem) into infra/dev/secrets/cards/ (0700, keys
+# 0600), replacing what was there. Without them card features are off, with one warning at start (§10.4, D-175).
+stage_card_keys() {
+  local src stage="$dev_dir/secrets/cards" key
+  src="$(dev_path "$(env_value KVITT_SECRETS_DIR ../secrets)")/cards"
+  rm -rf "$stage"
+  install -d -m 0700 "$stage"
+  if [[ -d "$src" ]]; then
+    for key in "$src"/*.pem; do
+      [[ -f "$key" ]] && install -m 0600 "$key" "$stage/$(basename "$key")"
+    done
+  fi
+  if [[ -z "$(ls -A "$stage")" ]]; then
+    echo "$(basename "$0"): no keys in $src; the server starts with card features off." >&2
+  fi
+}

infra/dev/up.sh

@@ -23,6 +23,7 @@ export KVITT_PUBLIC_URL="$public_url"
 data_dir="$(dev_path "$(env_value KVITT_DEV_DATA_DIR ./data)")"
 mkdir -p "$data_dir"
 stage_fcm_key
+stage_card_keys
 
 compose up -d server