fix: end-to-end audit remediation — money path, security, trust surfaces

[CodeWithEugene]

Summary

Full remediation of the 2026-09-27 end-to-end audit (85+ findings). Every critical and high item is fixed, tested, and verified live.

⚠️ Money-path changes — per repo policy this PR requires 2 maintainer approvals and a testnet deploy before the live-mode switch.

Critical money-path fixes

• Webhook outbox: replay of a stored event with processedAt NULL now re-processes instead of returning a bare duplicate (the crash-window money-loss hole). Stale-event sweep added to escrow cron; orphaned charges are verified with Paystack and paged to ops.
• Deposit overpayment cap: a second deposit landing on a locked vault records SUCCEEDED but never double-locks; audited + paged for manual refund.
• Attestation survival: cold-start vaultAddressFor fallback, state-aware handlers (skip already-applied writes, mirror missing ledger rows, retryable AttestationNotReadyError), retry ×10 / 1h expiry, reconcile now has the chain leg with auto-repair.
• Stuck-PROCESSING recovery: transferStatus provider-truth lookup; sweep resolves stuck payouts from Paystack state; admin retry refuses while the original transfer is unverified (double-pay path closed).
• Reversal integrity: clawback-after-success is paged, success-after-reversed is refused, manual-paid attests with the receipt, vault states self-heal in the payout cron.
• Refunds exist: refundLockedVault primitive + organizer (pre-funding) and admin (pre-winners, 2-admin dispute REFUND) cancellation paths.
• Announce validation: distinct teams, exact place coverage, atomic winner+milestone+payout creation, friendly double-submit errors.
• Judge/participant mutual exclusion at team join, invite activation, and openJudging.
• Contracts: hot attester key reduced to ATTESTER_ROLE only; factory rotateAttester (grant-before-revoke) with 5 new tests.

Security & ops

• CSP / HSTS / nosniff / Referrer-Policy / Permissions-Policy headers; X-Powered-By off (verified live).
• Rate limiting is now DB-backed (RateLimitBucket, async, in-memory fallback) with per-IP secondary limits; register/cancel/judge-invite routes covered.
• Fail-closed payments: keyless production throws unless PAYSTACK_ALLOW_SIMULATION_IN_PROD=true (explicit pre-go-live opt-in — set it in Vercel until real keys land).
• Dev upload routes: path-traversal fix, upload validation, event-membership authz, explicit prod guard.
• Sentry v11 wired (DSN-gated no-op without env), /api/health, coverage gate wired into CI (75/95/75 floors on escrow+payout, ratchet comment), operator-script prod guards, Cloudflare range auto-refresh.

Product integrity

• /trust public ledger restored (write-only attestation layer now has its surface; simulation-mode banner when applicable), /organizers/[slug] public trust pages, /organizer/organization settings, 13 loading.tsx skeletons.
• Invite-link onboarding dead-end fixed; claim-first invite acceptance with email binding; KYB PENDING precondition; newsletter re-subscribe confirmation + 90-day token TTL; registration receipts always-send on transition only.
• Media upload confirm-after-PUT (phantom assets impossible); dev cover route verifies uploads; scoring screen no longer fabricates 5/10 defaults; shared ConfirmMoneyAction across announce / milestone / mark-paid; prize-verified badge wired on listing + detail; wizard per-step validation; ghost/empty-state and stale-copy fixes.
• Seed rebuilt invariant-respecting (vaults for live events, full SETTLED graph, disputes, ADMIN/HIRING demo users); categories NOT NULL migration; docs synced (README, CONTRIBUTING, runbooks, BUILD_PLAN amendments, 45 stale image refs).

Verification

• pnpm typecheck ✅ zero errors · pnpm lint ✅ clean · pnpm build ✅ zero warnings (67 routes)
• 449 vitest (59 files) ✅ (was 336) · 14 hardhat ✅ (was 9)
• Coverage gate: 80.45% lines aggregate (escrow 85.8%, payout 74.7%) — thresholds 75/95/75 held
• Runtime smoke: /trust 200, /organizers/[slug] 200, /api/health 200 (db/queue ok), security headers present, dashboard auth redirect intact
• DB: 16 migrations applied, migrate diff empty, seed idempotent (3 runs), reconcile 0 findings

Deployment notes

• Set PAYSTACK_ALLOW_SIMULATION_IN_PROD=true in Vercel before this deploys (current prod intentionally runs simulation; without the flag the payment port now throws in production).
• Optional: SENTRY_DSN + SENTRY_AUTH_TOKEN to activate error reporting.