feat: resolve issues #125 #152 #154 #156

[JONAH-6]

Summary

Resolves four issues: database performance, device-based fraud detection, external webhook integration, and admin
observability.

• Optimize Database Indexing Strategy #125 — Add optimized indexes (composite, partial, unique) across transfers, audit_logs, users, and
  ledger_entries
• Add Device Fingerprinting for Fraud Detection #152 — Implement SHA-256 device fingerprinting from request headers+IP; flag unknown devices in auth risk engine
  and trigger step-up auth
• Add Transaction Webhook Support #154 — Add webhook registration API with HMAC-SHA256 signed delivery (timestamp anti-replay), SSRF prevention,
  5-attempt exponential retry with jitter, dead-letter status, and secret rotation
• Add Audit Trail for Admin Actions #156 — Add admin action audit trail middleware; log actor, IP, timestamp, and request metadata for all mutating
  admin routes; expose GET /admin/audit listing

Changes

Database (migrations/)

• 004_optimize_indexes.sql — composite, partial, and unique indexes for frequent query patterns
• 005_webhooks.sql — webhooks and webhook_deliveries tables with indexes
• 006_admin_audit.sql — admin_audit_logs table with indexes

Backend (src/)

• auth/deviceFingerprint.ts — SHA-256 fingerprint generator (user-agent + accept-* headers + IP)
• auth/riskEngine.ts — fingerprint-aware device tracking; fingerprint field on AuthEvent
• modules/webhooks/webhookService.ts — webhook CRUD, EventBus integration, SSRF validation, HMAC timestamp-signed
  delivery, 5-attempt exponential retry with jitter, dead-letter, secret rotation
• modules/admin/adminAuditService.ts — admin action log store
• middleware/adminAudit.ts — createAdminAuditHook(action) factory for Fastify preHandler
• routes/webhooks.ts — webhook management endpoints including secret rotation and manual delivery retry
• routes/auth.ts — fingerprint extraction and injection into auth events
• routes/admin.ts — audit hooks on mutating routes; GET /admin/audit and GET /admin/audit/:id
• container.ts — register webhooks, adminAudit, authRiskEngine, and other previously-untyped services in
  container interface and factory

Closes

Closes #125
Closes #152
Closes #154
Closes #156

[drips-wave]

@JONAH-6 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits