feat(payments): add daily reconciliation job for unmatched transactio…

[lamborghini21]

Summary

Closes #856 Adds a daily payment reconciliation job that compares locally recorded payments against the payment provider's transaction ledger, flags unmatched or mismatched transactions, and logs them as structured audit events. Also exposes an admin-only endpoint to retrieve the results of the last reconciliation run.

Changes

• src/payments/reconciliation/reconciliation.service.ts (new)

  • PaymentReconciliationJob runs daily at 02:00 UTC via @Cron.
  • Fetches provider transactions for the previous day.
  • Compares them against local Payment table records by provider transaction ID.
  • Detects three discrepancy types: local payments missing from the provider, provider transactions missing locally, and amount/status mismatches on matched records.
  • Writes each discrepancy as a structured audit event via the existing audit-log service.

• src/payments/reconciliation/reconciliation.controller.ts (new)

  • GET /payments/reconciliation/report — admin-only, returns the results of the last reconciliation run.

• src/audit-log/enums/audit-action.enum.ts

  • Added PAYMENT_RECONCILIATION_MISMATCH as a new audit action (additive only, no existing values changed).

• src/payments/payments.module.ts

  • Registered the new reconciliation service and controller.

• src/app.module.ts

  • Wired up scheduling module registration as needed for @Cron support.

Acceptance Criteria

• Reconciliation job runs daily at 02:00 UTC
• Mismatched transactions appear in the audit log
• Admin endpoint returns the last reconciliation report

Testing

Added src/payments/reconciliation/reconciliation.service.spec.ts covering:

• fully matched transactions (no discrepancy)
• local payment missing from provider
• provider transaction missing locally
• mismatched amount/status between local and provider records for the same transaction ID

All 4 scoped tests passing locally via Jest.

Notes

• Only files listed in the issue's impacted-files section were touched (reconciliation.service.ts, audit-action.enum.ts), plus the controller and module wiring needed to actually expose the endpoint and register the job.
• Admin-only access on the report endpoint uses the existing guard/role pattern already present in this codebase for other admin routes.
• No changes to package-lock.json or unrelated dependencies.

[drips-wave]

@lamborghini21 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits