K1: card purchases on the server (schema 4, Enable Banking adapter, E-36 to E-44)

Contract (SPEC §14.8): migration 0004_card_purchases.sql (server schema 4, byte-identical
contract and server copies), E-36 to E-44 in contracts/openapi.yaml with the four new error
codes and a 502 response, examples for every card body and error code, the
match_card_purchase vectors (17 cases) with their Python reference in tools/contracts-check.py
(157 checks), web/src/api/schema.d.ts regenerated; web/src/lib/vectors.test.ts lists
match_card_purchase as not ported until K3 ports it (orchestrator's allowance).

Server: src/cards/ with the provider registry (CP-1), the CardSource trait and its
Enable Banking adapter (JWT RS256 kid = application id, /aspsps, /auth, /sessions,
transactions with PSU headers for user-present fetches, CP-14 error mapping, CP-7 mapping),
the windowed fetch (30-day windows newest first, split at the 100-row cap down to a day,
de-duplication by provider_ref, continuation keys, WRONG_TRANSACTIONS_PERIOD ends the walk),
CP-8 matching with the secondary rule, the background poller (06:45, 11:45, 16:45, 21:45,
4 per 24 hours, 2-hour skip, no backlog), the bilingual callback page (E-39), E-36 to E-38
and E-40 to E-44, link clearing in sync push step 7, attempt pruning at 04:00, the card_fetch
log line with aggregates only, KVITT_EB_* configuration. Tests against a local stub
(tests/cards_api/, 34 tests); the real API is never called.

Infra: Pi compose mounts secrets/cards read-only and passes the two application ids;
.env.example keys; dev stack stages infra/secrets/cards/; NPM block with the /cards/callback
gate line and unlogged location (kvitt.conf and README step 4); README "Card purchases".

Pre-commit hook bypassed (--no-verify, orchestrator's decision): the Android fast tests fail
in :domain VectorFilesTest (and the full check in :data ExampleRoundTripTest) because they pin
the contract's vector and example sets; matchCardPurchase and the card DTOs are K2's by design
(contract-first landing; K2 lands next). Server, contracts-check and web gates are green.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B

server/crates/kvitt-server/tests/skeleton/wire_examples.rs

@@ -72,6 +72,17 @@ fn check(name: &str, example: &Value) -> bool {
         "E-33-settlement-proposal/response.json" => ProposalResponse,
         "E-34-analytics-trends/response.json" => TrendsResponse,
         "E-35-analytics-forecast/response.json" => ForecastResponse,
+        "E-36-card-providers/response.json" => CardProviderList,
+        "E-37-card-auth/request.json" => CreateCardAuthRequest,
+        "E-37-card-auth/response.json" => CardAttempt,
+        "E-38-card-attempt/response.json" => CardAttempt,
+        "E-40-card-sync/response.json" => CardSyncResponse,
+        "E-41-card-connection-update/request.json" => PatchCardConnectionRequest,
+        "E-41-card-connection-update/response.json" => CardConnection,
+        "E-42-card-refresh/response.json" => CardRefreshResponse,
+        "E-43-card-disconnect/response.json" => CardConnection,
+        "E-44-card-purchase-update/request.json" => PutCardPurchaseRequest,
+        "E-44-card-purchase-update/response.json" => CardPurchase,
         "sync/pull-empty-page.json" => SyncPullResponse,
         "sync/pull-page.json" => SyncPullResponse,
         "sync/pull-page-categories-v2.json" => SyncPullResponse,
@@ -133,4 +144,9 @@ fn absent_and_null_are_distinct_where_the_contract_says_so() {
     // E-12: target_user_id may be absent.
     let invite: CreateInviteRequest = serde_json::from_str(r#"{"kind": "partner"}"#).unwrap();
     assert_eq!(invite.target_user_id, None);
+    // E-44: both keys required, expense_id nullable.
+    assert!(serde_json::from_str::<PutCardPurchaseRequest>(r#"{"ignored": true}"#).is_err());
+    let unlink: PutCardPurchaseRequest =
+        serde_json::from_str(r#"{"expense_id": null, "ignored": false}"#).unwrap();
+    assert_eq!(unlink.expense_id, None);
 }