K1: card purchases on the server (schema 4, Enable Banking adapter, E-36 to E-44)

Contract (SPEC §14.8): migration 0004_card_purchases.sql (server schema 4, byte-identical
contract and server copies), E-36 to E-44 in contracts/openapi.yaml with the four new error
codes and a 502 response, examples for every card body and error code, the
match_card_purchase vectors (17 cases) with their Python reference in tools/contracts-check.py
(157 checks), web/src/api/schema.d.ts regenerated; web/src/lib/vectors.test.ts lists
match_card_purchase as not ported until K3 ports it (orchestrator's allowance).

Server: src/cards/ with the provider registry (CP-1), the CardSource trait and its
Enable Banking adapter (JWT RS256 kid = application id, /aspsps, /auth, /sessions,
transactions with PSU headers for user-present fetches, CP-14 error mapping, CP-7 mapping),
the windowed fetch (30-day windows newest first, split at the 100-row cap down to a day,
de-duplication by provider_ref, continuation keys, WRONG_TRANSACTIONS_PERIOD ends the walk),
CP-8 matching with the secondary rule, the background poller (06:45, 11:45, 16:45, 21:45,
4 per 24 hours, 2-hour skip, no backlog), the bilingual callback page (E-39), E-36 to E-38
and E-40 to E-44, link clearing in sync push step 7, attempt pruning at 04:00, the card_fetch
log line with aggregates only, KVITT_EB_* configuration. Tests against a local stub
(tests/cards_api/, 34 tests); the real API is never called.

Infra: Pi compose mounts secrets/cards read-only and passes the two application ids;
.env.example keys; dev stack stages infra/secrets/cards/; NPM block with the /cards/callback
gate line and unlogged location (kvitt.conf and README step 4); README "Card purchases".

Pre-commit hook bypassed (--no-verify, orchestrator's decision): the Android fast tests fail
in :domain VectorFilesTest (and the full check in :data ExampleRoundTripTest) because they pin
the contract's vector and example sets; matchCardPurchase and the card DTOs are K2's by design
(contract-first landing; K2 lands next). Server, contracts-check and web gates are green.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

infra/pi/.env.example

@@ -13,5 +13,11 @@ HA_HOST=CHANGE_ME
 KVITT_UID=1000
 # compose.yaml: gid both containers run as, `id -g` of the same user.
 KVITT_GID=1000
+# compose.yaml: the server's KVITT_EB_APP_ID, the Enable Banking application id for card purchases (SPEC §10.4,
+# D-175): the key file's name before .pem. Empty: card features off. The key goes to secrets/cards/enable-banking.pem.
+KVITT_EB_APP_ID=
+# compose.yaml: the server's KVITT_EB_MEMBER_APP_ID, only for a member's own application (CP-13 fallback); empty: the
+# member uses KVITT_EB_APP_ID. Its key goes to secrets/cards/enable-banking-member.pem.
+KVITT_EB_MEMBER_APP_ID=
 # compose.yaml: the backup's Google Drive folder id (OQ-4).
 RCLONE_FOLDER_ID=1jDp1dGE5R3H2DBcXCqIPN1iWzQnPkdlV

infra/pi/compose.yaml

@@ -37,8 +37,13 @@ services:
       # NPM's LAN address: only a request whose TCP peer is this address may set X-Forwarded-For, whose last entry
       # is then the client IP of the rate limits (SPEC §8.5, §8.6, D-120). An IPv4 address, not a host name.
       KVITT_TRUSTED_PROXY: ${HA_HOST:?set HA_HOST in .env}
+      # Card purchases (SPEC §9.12, §10.4, D-175): the Enable Banking application ids; empty = card features off,
+      # with one warning at start. The keys are secrets/cards/enable-banking.pem (and enable-banking-member.pem for
+      # a member's own application), the KVITT_EB_KEY_FILE and KVITT_EB_MEMBER_KEY_FILE defaults.
+      KVITT_EB_APP_ID: ${KVITT_EB_APP_ID:-}
+      KVITT_EB_MEMBER_APP_ID: ${KVITT_EB_MEMBER_APP_ID:-}
       # The other server settings keep their SPEC §10.4 defaults (KVITT_FCM_CREDENTIALS
-      # /secrets/fcm-service-account.json, KVITT_FCM_PROJECT_ID kvitt-1337, ...).
+      # /secrets/fcm-service-account.json, KVITT_FCM_PROJECT_ID kvitt-1337, KVITT_EB_API_URL, ...).
     volumes:
       # SQLite database, pictures and APKs (data/apk/).
       - ./data:/data
@@ -50,6 +55,14 @@ services:
         read_only: true
         bind:
           create_host_path: false
+      # The Enable Banking private keys (D-175), read-only; the folder is 0700 and each key 0600, owned by the owner.
+      # create_host_path false: a missing folder stops the start instead of Docker creating a root-owned one.
+      - type: bind
+        source: ./secrets/cards
+        target: /secrets/cards
+        read_only: true
+        bind:
+          create_host_path: false
       # Empty except during the one-off Splitwise import (SPEC §10.8, D-025).
       - ./import:/import:ro
     healthcheck: