K1: card purchases on the server (schema 4, Enable Banking adapter, E-36 to E-44)

Contract (SPEC §14.8): migration 0004_card_purchases.sql (server schema 4, byte-identical
contract and server copies), E-36 to E-44 in contracts/openapi.yaml with the four new error
codes and a 502 response, examples for every card body and error code, the
match_card_purchase vectors (17 cases) with their Python reference in tools/contracts-check.py
(157 checks), web/src/api/schema.d.ts regenerated; web/src/lib/vectors.test.ts lists
match_card_purchase as not ported until K3 ports it (orchestrator's allowance).

Server: src/cards/ with the provider registry (CP-1), the CardSource trait and its
Enable Banking adapter (JWT RS256 kid = application id, /aspsps, /auth, /sessions,
transactions with PSU headers for user-present fetches, CP-14 error mapping, CP-7 mapping),
the windowed fetch (30-day windows newest first, split at the 100-row cap down to a day,
de-duplication by provider_ref, continuation keys, WRONG_TRANSACTIONS_PERIOD ends the walk),
CP-8 matching with the secondary rule, the background poller (06:45, 11:45, 16:45, 21:45,
4 per 24 hours, 2-hour skip, no backlog), the bilingual callback page (E-39), E-36 to E-38
and E-40 to E-44, link clearing in sync push step 7, attempt pruning at 04:00, the card_fetch
log line with aggregates only, KVITT_EB_* configuration. Tests against a local stub
(tests/cards_api/, 34 tests); the real API is never called.

Infra: Pi compose mounts secrets/cards read-only and passes the two application ids;
.env.example keys; dev stack stages infra/secrets/cards/; NPM block with the /cards/callback
gate line and unlogged location (kvitt.conf and README step 4); README "Card purchases".

Pre-commit hook bypassed (--no-verify, orchestrator's decision): the Android fast tests fail
in :domain VectorFilesTest (and the full check in :data ExampleRoundTripTest) because they pin
the contract's vector and example sets; matchCardPurchase and the card DTOs are K2's by design
(contract-first landing; K2 lands next). Server, contracts-check and web gates are green.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-server/tests/cards_api/logging.rs

@@ -0,0 +1,143 @@
+//! SPEC §8.7, AC-22.14: the logs of a connection, its fetches and a callback carry the aggregate `card_fetch` line and
+//! never a merchant text, an amount, a purchase date, the `state`, the authorisation code, the session id, the account
+//! uid, the holder's name, the card number or a response body of the bank.
+
+use std::io::Write;
+use std::sync::{Arc, Mutex};
+
+use axum::http::Method;
+
+use crate::common::*;
+use crate::stub::eb_error;
+use crate::support::*;
+
+#[derive(Clone, Default)]
+struct Captured(Arc<Mutex<Vec<u8>>>);
+
+impl Write for Captured {
+    fn write(&mut self, buf: &[u8]) -> std::io::Result<usize> {
+        self.0.lock().unwrap().extend_from_slice(buf);
+        Ok(buf.len())
+    }
+    fn flush(&mut self) -> std::io::Result<()> {
+        Ok(())
+    }
+}
+
+#[tokio::test]
+async fn card_logs_hold_no_card_content() {
+    let captured = Captured::default();
+    let writer = captured.clone();
+    let subscriber = tracing_subscriber::fmt()
+        .json()
+        .with_max_level(tracing::Level::TRACE)
+        .with_current_span(true)
+        .with_writer(move || writer.clone())
+        .finish();
+    // Global: the other tests of this binary run in parallel and are captured too, which only widens the check.
+    tracing::subscriber::set_global_default(subscriber).unwrap();
+
+    let app = CardsApp::new().await;
+    app.stub.set_transactions(vec![
+        pending(
+            "ref-hemlig-1",
+            "2026-10-09",
+            "4321.09",
+            "Hemligbutiken Ankeborg",
+        ),
+        booked(
+            "ref-hemlig-2",
+            "2026-10-08",
+            "8765.43",
+            "Topphemliga Kaféet",
+        ),
+    ]);
+    let connection = app.connect(&admin_token(), 30).await;
+    let state = app.stub.last_state();
+    app.stub.set_transactions(vec![
+        booked(
+            "ref-hemlig-1",
+            "2026-10-10",
+            "4321.09",
+            "Hemligbutiken Ankeborg",
+        ),
+        booked(
+            "ref-hemlig-2",
+            "2026-10-08",
+            "8765.43",
+            "Topphemliga Kaféet",
+        ),
+    ]);
+    app.refetch(&admin_token(), &connection).await;
+    app.stub
+        .script_transactions(&[eb_error(500, "ASPSP_ERROR")]);
+    app.refetch(&admin_token(), &connection).await;
+    app.callback(&format!("code=code-secret-1&state={state}"), "sv")
+        .await;
+    app.call(
+        Method::DELETE,
+        &format!("/cards/connections/{connection}"),
+        &admin_token(),
+        None,
+    )
+    .await;
+
+    // Latencies are random numbers that may contain any digits; they are not card data.
+    let logs: String = String::from_utf8(captured.0.lock().unwrap().clone())
+        .unwrap()
+        .lines()
+        .map(
+            |line| match serde_json::from_str::<serde_json::Value>(line) {
+                Ok(mut v) => {
+                    if let Some(fields) = v.get_mut("fields").and_then(|f| f.as_object_mut()) {
+                        fields.remove("latency_ms");
+                    }
+                    v.to_string()
+                }
+                Err(_) => line.to_owned(),
+            },
+        )
+        .collect::<Vec<_>>()
+        .join("\n");
+    assert!(logs.contains("\"route\":\"/cards/callback\""), "{logs}");
+    let fetch_lines: Vec<&str> = logs.lines().filter(|l| l.contains("card_fetch")).collect();
+    assert!(fetch_lines.len() >= 3, "{logs}");
+    assert!(
+        fetch_lines
+            .iter()
+            .any(|l| l.contains("\"booked_by_ref\":1") && l.contains("\"kind\":\"user\"")),
+        "{fetch_lines:#?}"
+    );
+    assert!(
+        fetch_lines
+            .iter()
+            .any(|l| l.contains("\"error_code\":\"bank_unavailable\""))
+    );
+    assert!(
+        fetch_lines
+            .iter()
+            .all(|l| l.contains("\"requests\":") && l.contains("\"windows_split\":"))
+    );
+    for secret in [
+        "Hemligbutiken",
+        "Topphemliga",
+        "4321.09",
+        "432109",
+        "8765.43",
+        "876543",
+        "2026-10-09",
+        "2026-10-08",
+        "ref-hemlig",
+        state.as_str(),
+        "code-secret-1",
+        "sess-secret-1",
+        "acc-secret-1",
+        HOLDER_NAME,
+        CARD_NUMBER,
+        MERCHANT_TOWN,
+        APP_ID,
+        "a body the server must never log",
+    ] {
+        assert!(!logs.contains(secret), "log contains {secret}:\n{logs}");
+    }
+}