019fbdf5 - Automate Bank Frick vIBAN recovery

[TaprootFreak]

Summary

• recover exact Bank Frick vIBAN matches without repeating create after an ambiguous outcome
• select a deterministic canonical vIBAN and clean duplicates only through protected completed-intent reconciliation
• move unresolved issuance intents to collection-account fallback after 24 hours only after a successful, time-valid, fully validated listing
• clean delayed retired-reference vIBANs while refusing to deactivate protected IBANs
• emit PII-safe ERROR logs for every ambiguous result and failed automatic action, without additional monitoring mail

Safety

• no second create request after an ambiguous Bank Frick response
• immutable request-reference and reference-account binding
• locked, idempotent state transitions with the canonical IBAN persisted in externalIban
• strict RFC 3339 listing timestamps and fail-closed handling of incomplete or invalid listings
• local active-vIBAN and completed-canonical protection before every external deactivation
• indefinitely retryable duplicate and retired-reference cleanup

Tests

• npm run format:check
• npm run lint
• npm run type-check
• npx jest --runInBand src/subdomains/supporting/bank/virtual-iban/__tests__/virtual-iban.service.spec.ts (169 tests)
• npm run test:frick:cov (635 tests; 100% statements, branches, functions, and lines for all Frick gate files)
• final-head CI: build/checks, three test shards, coverage, coverage ratchet, review, and CodeQL all successful

[TaprootFreak]

PR readiness completed after 10 review passes. Follow-up fixes addressed canonical-first recovery, persistent protected duplicate cleanup, prevention of duplicate external deactivation, fully validated fallback gating, reference-account snapshot validation, mandatory PII-safe ERROR logging, strict RFC 3339 timestamp validation and chronological canonical selection, removal of obsolete alert/test scaffolding, query-accurate repository mocks, documentation consistency, whitespace-safe runbook verification, and accurate terminal fallback diagnostics. Both final full-diff reviews found 0 defects, and all checks pass on the latest head.