feat: P0+P1 platform improvements — JWT, Redis, microservices, Kafka, TigerBeetle, mobile parity

[devin-ai-integration]

Summary

Implements all 14 P0+P1 improvement recommendations from the platform audit.

P0 — Critical pre-production (6 items):

• server.cjs: JWT auth with signAccessToken()/signRefreshToken()/verifyToken() replacing crypto.randomBytes session tokens. Access 15m + refresh 7d, issuer-validated.
• Redis via ioredis for sessionStore/rateLimitStore/cacheStore with transparent in-memory Map() fallback when Redis unavailable.
• seed-all-tables.sql + seed-fix.sql: 10 previously empty tables seeded with Nigerian insurance data (analytics_metrics, backup_snapshots, fee_rules, knowledge_graph, sla_definitions, transactions).
• Bcrypt-only auth: auth.login rejects non-$2 password hashes, auth.changePassword enforces 8char + uppercase + number.
• cors() middleware with CORS_ORIGINS env var (comma-separated, defaults to localhost:5002/5173/3000).
• sendEmail() via Nodemailer SMTP + sendSMS() via Termii API for OTP delivery.

P1 — Pre-launch (8 items):

• Microservices: services/{auth,payment,naicom}-service/ — standalone Express apps on ports 5010-5012 with own package.json.
• OpenSearch: infrastructure/opensearch/search-client.js with nigerian_analyzer (synonym filter for motor/health/naira), 5 indices (policies, claims, customers, agents, audit_log), syncFromDB() + ILIKE fallback.
• APISIX: infrastructure/apisix/routes.yaml — JWT-gated routes for payments/NAICOM, rate limiting, Paystack webhook IP whitelist.
• Keycloak: infrastructure/keycloak/realm-export.json — 7 realm roles, 4 clients (web OIDC, mobile OIDC, API service account, bank SAML), Google IdP, TOTP, brute-force protection.
• Kafka: infrastructure/kafka/{event-producer,event-consumer}.js + topics.yaml — 21 topics for claims/policy/payment/audit/fraud/KYC/reinsurance lifecycle. Producer with idempotent delivery, consumer with per-topic handlers updating PostgreSQL.
• TigerBeetle: infrastructure/tigerbeetle/ledger.js — Nigerian insurance chart of accounts (1xxx assets through 5xxx expenses), recordPremiumPayment/recordClaimPayment/recordCommission/recordReinsuranceCession/trialBalance with PostgreSQL GL fallback.
• Mobile: 5 new screens (Notifications, Wallet, Support, Analytics, Referral) added to AppNavigator.tsx — total now 22 screens.
• Integration tests: tests/integration.test.js — 22 tests covering health, auth, products, policies, claims, IFRS 17, NAICOM, USSD, payments, fraud, zero-stub verification.

Infrastructure: infrastructure/docker-compose.yaml with PostgreSQL 16 + Redis 7 + OpenSearch 2.15 + Kafka 7.6 + APISIX 3.9 + Keycloak 25 + TigerBeetle 0.15 + etcd.

Link to Devin session: https://app.devin.ai/sessions/0475192a778b45cea30202f85ad52b63

[devin-ai-integration]

Original prompt from Patrick

https://drive.google.com/file/d/17FqTB6666Z-CYrffikjqdPh1-qWXxQXf/view?usp=sharing
Extract the entire archive, analyze and search for orphan, partially and generic scaffolded features across the platform - fully implement them end to end -generic CRUD-only patterns , modules with no domain logic, disconnected features, and incomplete implementations.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

End-to-End Test Results — 8/8 Passed

Tested by: Devin session | CI: 83/83 green

API Tests (5/5 passed)

Test	Result	Evidence
CORS (allowed origins)	✅	Access-Control-Allow-Origin: http://localhost:5002 + credentials
CORS (blocked origin)	✅	evil.com → no Access-Control headers
Security headers	✅	HSTS, X-Frame-Options DENY, nosniff, XSS all present
Health + Metrics	✅	/health healthy, /health/ready DB+Redis connected, /metrics 0% error rate
Signup validation	✅	Weak password rejected, valid password → JWT (eyJ..., 3 parts), kycLevel=0
Token refresh	✅	Valid token → new JWT, invalid token → "Invalid or expired refresh token"

Browser Tests (3/3 passed)

Test	Result	Evidence
JWT login (valid creds)	✅	insureportal-token = eyJ... (3 parts), redirected to /dashboard
Invalid creds rejection	✅	Red "Invalid email or password" banner, no token stored, stays on /auth
Dashboard with DB data	✅	20 policies, 6 claims, ₦15M payments from PostgreSQL

Non-blocking Observations

1. Browser tRPC client latency ~50s — Server responds in <15ms but browser login mutation takes ~50s. Known issue from PRs feat: auth features (logout, reset password, 2FA) + tRPC 1000x perf fix + mobile parity #72/feat: eliminate all 162 mock routes + bcrypt auth + IFRS 17 + NAICOM pipeline + reinsurance cession + payment gateways #73. Server-side O(1) fix works; bottleneck is browser-side superjson transformer.
2. Dashboard "Recent Activity" dates show "Invalid Date" — Pre-existing date parsing issue, not introduced by this PR.

Key Evidence

CORS (allowed):

Access-Control-Allow-Origin: http://localhost:5002
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: X-Request-ID

Security headers:

X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-XSS-Protection: 1; mode=block
Strict-Transport-Security: max-age=31536000; includeSubDomains

Health endpoints:

/health: {"status":"healthy","version":"2.2.0"}
/health/ready: {"database":"connected","redis":"connected"}
/metrics: {"errorRate":"0.00%","avgLatency":"12ms"}

JWT token (signup):

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MTA5...
kycLevel: 0, requiresKyc: true, 6 KYC steps remaining