K1: card purchases on the server (schema 4, Enable Banking adapter, E-36 to E-44)

Contract (SPEC §14.8): migration 0004_card_purchases.sql (server schema 4, byte-identical
contract and server copies), E-36 to E-44 in contracts/openapi.yaml with the four new error
codes and a 502 response, examples for every card body and error code, the
match_card_purchase vectors (17 cases) with their Python reference in tools/contracts-check.py
(157 checks), web/src/api/schema.d.ts regenerated; web/src/lib/vectors.test.ts lists
match_card_purchase as not ported until K3 ports it (orchestrator's allowance).

Server: src/cards/ with the provider registry (CP-1), the CardSource trait and its
Enable Banking adapter (JWT RS256 kid = application id, /aspsps, /auth, /sessions,
transactions with PSU headers for user-present fetches, CP-14 error mapping, CP-7 mapping),
the windowed fetch (30-day windows newest first, split at the 100-row cap down to a day,
de-duplication by provider_ref, continuation keys, WRONG_TRANSACTIONS_PERIOD ends the walk),
CP-8 matching with the secondary rule, the background poller (06:45, 11:45, 16:45, 21:45,
4 per 24 hours, 2-hour skip, no backlog), the bilingual callback page (E-39), E-36 to E-38
and E-40 to E-44, link clearing in sync push step 7, attempt pruning at 04:00, the card_fetch
log line with aggregates only, KVITT_EB_* configuration. Tests against a local stub
(tests/cards_api/, 34 tests); the real API is never called.

Infra: Pi compose mounts secrets/cards read-only and passes the two application ids;
.env.example keys; dev stack stages infra/secrets/cards/; NPM block with the /cards/callback
gate line and unlogged location (kvitt.conf and README step 4); README "Card purchases".

Pre-commit hook bypassed (--no-verify, orchestrator's decision): the Android fast tests fail
in :domain VectorFilesTest (and the full check in :data ExampleRoundTripTest) because they pin
the contract's vector and example sets; matchCardPurchase and the card DTOs are K2's by design
(contract-first landing; K2 lands next). Server, contracts-check and web gates are green.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-server/src/api/rate_limit.rs

@@ -64,9 +64,14 @@ pub const PROXY_RESOLVE_INTERVAL: std::time::Duration = std::time::Duration::fro
 /// How often expired windows are pruned from memory.
 const PRUNE_INTERVAL: Duration = Duration::minutes(10);
 
-/// Route templates of the unauthenticated endpoints (E-1 to E-6) and of the web client (D-132), which count against
-/// the client IP even when a request carries a bearer token.
-const PUBLIC_ROUTES: [&str; 9] = [
+/// The client IP of a request as the limiter determined it (SPEC §8.5, §8.6), in the request extensions for the
+/// handlers that need it (the card PSU headers, CP-5).
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct ClientIp(pub IpAddr);
+
+/// Route templates of the unauthenticated endpoints (E-1 to E-6, E-39) and of the web client (D-132), which count
+/// against the client IP even when a request carries a bearer token.
+const PUBLIC_ROUTES: [&str; 10] = [
     "/health",
     "/setup/status",
     "/invites/accept",
@@ -76,6 +81,8 @@ const PUBLIC_ROUTES: [&str; 9] = [
     "/app",
     "/app/",
     "/app/{*path}",
+    // E-39, the bank's redirect (SPEC §8.6, D-162).
+    "/cards/callback",
 ];
 const ACCEPT_ROUTE: &str = "/invites/accept";
 /// Route template of E-6, limited by [`APK_DOWNLOAD_LIMIT`] instead of [`UNAUTHENTICATED_LIMIT`].
@@ -363,7 +370,7 @@ impl Limiter {
         }
     }
 
-    async fn handle<S>(self: Arc<Self>, request: Request, mut inner: S) -> Response
+    async fn handle<S>(self: Arc<Self>, mut request: Request, mut inner: S) -> Response
     where
         S: Service<Request, Response = Response, Error = Infallible>,
     {
@@ -376,6 +383,7 @@ impl Limiter {
         let (peer, forwarded) = Self::peer_and_forwarded(&request);
         let ip = self.client_ip(peer, forwarded).await;
         let key = Self::key(&request, &route, ip);
+        request.extensions_mut().insert(ClientIp(ip));
         let admitted = match self.admit(&key, accept, self.clock.now()) {
             Ok(admitted) => admitted,
             Err(retry_after) => return AppError::rate_limited(retry_after).into_response(),