K1: card purchases on the server (schema 4, Enable Banking adapter, E-36 to E-44)

Contract (SPEC §14.8): migration 0004_card_purchases.sql (server schema 4, byte-identical
contract and server copies), E-36 to E-44 in contracts/openapi.yaml with the four new error
codes and a 502 response, examples for every card body and error code, the
match_card_purchase vectors (17 cases) with their Python reference in tools/contracts-check.py
(157 checks), web/src/api/schema.d.ts regenerated; web/src/lib/vectors.test.ts lists
match_card_purchase as not ported until K3 ports it (orchestrator's allowance).

Server: src/cards/ with the provider registry (CP-1), the CardSource trait and its
Enable Banking adapter (JWT RS256 kid = application id, /aspsps, /auth, /sessions,
transactions with PSU headers for user-present fetches, CP-14 error mapping, CP-7 mapping),
the windowed fetch (30-day windows newest first, split at the 100-row cap down to a day,
de-duplication by provider_ref, continuation keys, WRONG_TRANSACTIONS_PERIOD ends the walk),
CP-8 matching with the secondary rule, the background poller (06:45, 11:45, 16:45, 21:45,
4 per 24 hours, 2-hour skip, no backlog), the bilingual callback page (E-39), E-36 to E-38
and E-40 to E-44, link clearing in sync push step 7, attempt pruning at 04:00, the card_fetch
log line with aggregates only, KVITT_EB_* configuration. Tests against a local stub
(tests/cards_api/, 34 tests); the real API is never called.

Infra: Pi compose mounts secrets/cards read-only and passes the two application ids;
.env.example keys; dev stack stages infra/secrets/cards/; NPM block with the /cards/callback
gate line and unlogged location (kvitt.conf and README step 4); README "Card purchases".

Pre-commit hook bypassed (--no-verify, orchestrator's decision): the Android fast tests fail
in :domain VectorFilesTest (and the full check in :data ExampleRoundTripTest) because they pin
the contract's vector and example sets; matchCardPurchase and the card DTOs are K2's by design
(contract-first landing; K2 lands next). Server, contracts-check and web gates are green.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/README.md

@@ -35,13 +35,19 @@ Configuration is environment variables only (SPEC §10.4, exhaustive):
 | `KVITT_FCM_PROJECT_ID` | `kvitt-1337` | FCM project. |
 | `KVITT_TRUSTED_PROXY` | `none` | IP literal or host name allowed to set `X-Forwarded-For` (on the Pi `HA_HOST`, NPM's LAN address); `none` or a name that does not resolve means no proxy. |
 | `KVITT_WEB_DIR` | `/app` | The built web client, served under `/app/` (D-132): `index.html` for app routes, `assets/*` cached for a year, the app's own CSP. Missing directory: every `/app` path is 404 `not_found` (as with `cargo run`, unless you point it at `web/dist`). |
+| `KVITT_EB_APP_ID` | empty | Enable Banking application id for card purchases (SPEC §10.4, D-175): the admin's, and the member's unless the next is set. Empty, or its key missing or unusable: card features off for that user (one warning at start). |
+| `KVITT_EB_KEY_FILE` | `/secrets/cards/enable-banking.pem` | The PEM private key of `KVITT_EB_APP_ID`; never logged, never in `data/`. |
+| `KVITT_EB_MEMBER_APP_ID` | empty | The member's own application (CP-13 fallback). |
+| `KVITT_EB_MEMBER_KEY_FILE` | `/secrets/cards/enable-banking-member.pem` | Its key. |
+| `KVITT_EB_API_URL` | `https://api.enablebanking.com` | Card API base URL; the tests point it at a local stub. |
 | `RUST_LOG` | `info` | tracing filter; logs are JSON lines on stdout. |
 
 The default data directory `/data` is the container volume. When running outside Docker, set `KVITT_DATA_DIR`
 (for example `./data`, which `server/.gitignore` keeps out of git); the
 database is then `$KVITT_DATA_DIR/kvitt.sqlite`. Every connection uses WAL, `foreign_keys = ON`,
 `synchronous = NORMAL`, `busy_timeout = 5000` (SPEC §8.9). `serve` and `migrate` run the embedded migrations
-(`crates/kvitt-server/migrations/`, `0001_init.sql` byte-identical to `contracts/schema/server-v1.sql`).
+(`crates/kvitt-server/migrations/`, `0001_init.sql` byte-identical to `contracts/schema/server-v1.sql`, 0002 to 0004 to
+their copies in `contracts/schema/migrations/`; schema version 4).
 
 ## Subcommands
 
@@ -79,6 +85,14 @@ Building blocks for handler authors (`src/api/mod.rs`, `src/auth.rs`, `src/error
 * `AppState.clock` (`time::Clock`; tests use `FixedClock`), `time::format_ts` for the fixed RFC 3339 form,
   `time::STOCKHOLM`.
 
+Card purchases (SPEC §9.12, E-36 to E-44) live in `src/cards/`: the registry (`providers.rs`), the `CardSource`
+trait with Kvitt's own records (`mod.rs`) and its one adapter `enable_banking/` (the only code naming the vendor or
+reading its JSON: JWT, `/aspsps`, `/auth`, `/sessions`, transactions, the CP-7 mapping), the windowed fetch and CP-8
+matching (`fetch.rs`), the background poller (`poller.rs`, started by `tasks::start`), the callback page
+(`callback.rs`, E-39) and the other endpoints (`api.rs`). Card rows take `card_version` from `card_sequence`, never
+`server_version`, and are not audited or pushed; `cards::unlink_expense` is called by sync push step 7. `AppState.cards`
+is disabled until `tasks::start` installs the configured sources.
+
 The OpenAPI document is generated with utoipa from the `#[utoipa::path]` annotations and the wire types in
 `src/wire/`; `src/openapi.rs` lists the handlers and applies the document-wide rules. A handler change that alters
 the wire contract makes `tests/openapi_contract.rs` fail against `contracts/openapi.yaml`.
@@ -93,7 +107,8 @@ the wire contract makes `tests/openapi_contract.rs` fail against `contracts/open
 * **Background tasks:** `src/tasks/mod.rs` has `pub fn start(state: AppState) -> AppState`,
   called once by `serve` after migrations; it installs the push queue in the returned state (the router is built from
   it) and spawns the FCM sender, the recurring scheduler (at start and daily 06:00 Europe/Stockholm, through
-  `generate_all_due`) and the `sync_mutations` pruning (daily 04:00). The scheduler loop (`tasks/scheduler.rs`) reads
+  `generate_all_due`), the `sync_mutations` and `card_auth_attempts` pruning (daily 04:00) and the card poller
+  (06:45, 11:45, 16:45, 21:45, SPEC §9.12 CP-4). The scheduler loop (`tasks/scheduler.rs`) reads
   the injectable `AppState.clock` and re-checks it at least every 30 s, so clock jumps are handled.
 * **Audit (`src/audit/mod.rs`):**
 
@@ -134,8 +149,8 @@ The pre-commit hook (`tools/git-hooks/pre-commit`) runs `cargo audit --no-fetch`
 `Cargo.toml` under `server/` is staged, so ordinary commits stay fast. When `cargo-audit` is not installed or the
 database was never fetched it prints a message and skips the check; it never fails a commit for a missing tool.
 
-* `crates/kvitt-domain/tests/vectors.rs`: every case of every file in `contracts/test-vectors/` (the two
-  Kotlin-only analytics files are parsed and skipped).
+* `crates/kvitt-domain/tests/vectors.rs`: every case of every file in `contracts/test-vectors/` (the Kotlin-only
+  files, and `match_card_purchase.json` of the phone and the web, are parsed and skipped).
 * `crates/kvitt-server/tests/openapi_contract.rs`: the generated document equals `contracts/openapi.yaml` after
   the normalisations documented at the top of the file, plus self-tests that the comparison catches changes.
 * `crates/kvitt-server/tests/skeleton/`: migration identity and pragmas, every route registered and implemented, E-1, E-2,
@@ -152,6 +167,10 @@ database was never fetched it prints a message and skips the check; it never fai
   (an RSA key is generated per test; none is committed).
 * `crates/kvitt-server/tests/scheduler_daily/`: 06:00 and 04:00 across both DST changes, run at start, clock
   jumps, catch-up through `generate_all_due`, paused and deleted templates skipped, 90-day pruning.
+* `crates/kvitt-server/tests/cards_api/`: card purchases against a local Enable Banking stub (RSA key generated per
+  test): the connect flow and the callback page, the windowed fetch (splits, truncation, de-duplication, continuation,
+  end of history), the mapping and the fields never stored, CP-8 matching and deletion, CP-14 errors, the poller with
+  a scripted clock, E-36 to E-44 with their authorization, link clearing on expense delete, E-39's rate limit, logs.
 * `crates/kvitt-import/tests/import.rs`: both header variants, split and settlement rules, `--fx`, the import key and
   idempotent re-runs, reconciliation and its exit codes, dry run, the CLI, and the §10.8 category table against
   `data/splitwise_categories.csv`; synthetic fixtures in `crates/kvitt-import/tests/fixtures/` only.