PayGate v3 operator payment management

[Phloraxx]

Scope

Builds the recovered PayGate v3 operator/admin product on the exact v2 foundation commit a89845b7.

• simplifies daily navigation to Overview / Payments / Action / Health, with a dedicated More hub for advanced tools
• keeps advanced investigation/recovery tools reachable on mobile without crowding the main workflow
• adds full-history payment search, validated filters, sorting, pagination and totals
• expands search across IDs, customer fields, captured payer name, UPI/reference, description and private admin note
• adds typed payment detail views and operator-owned customer/business profile fields
• adds transactional audit logging with changed-field lists plus before/after editable-profile snapshots; custom JSON is represented by a digest
• adds protected-field copy actions for common operator workflows
• adds the v3 recovery contract and Oracle reconciliation record under docs/v3/

Safety boundaries

The profile update endpoint cannot edit payment matching, lifecycle, evidence, uniqueness, or create-request identity fields. In particular, externalId and original metadata are read-only because they participate in create/idempotency replay identity. Unknown/protected update keys fail with HTTP 400.

The migration is additive and the SQLite single-writer invariant is unchanged.

Oracle v3 reconciliation

The stranded original Oracle worktree (redesign/paygate-product-v3) was recovered and compared against this branch from the same a89845b7 base.

Carried forward: More hub/mobile advanced access, broader search, status sort, copy actions, and richer before/after audit snapshots.

Intentionally rejected from the draft: editable externalId/original metadata, non-strict JSON updates, silently clamped invalid queries, silently dropped oversized tags, and broader unbounded profile limits.

Full disposition: docs/v3/01_ORACLE_RECONCILIATION.md.

Validation

Final source head: 80ddb1af0c7a64e3b49f4cd51ff37ff473fa5798.

• GitHub CI run #142 ✅ — frontend dependency audit/typecheck/build, Go formatting, whitespace check, Go tests, full Go race tests, vet, staticcheck, govulncheck and production container build
• independent full go test -race -p=1 -timeout=20m -count=1 ./internal/... on macOS ✅
• focused final-delta race checks for internal/operatoradmin and internal/operatorview ✅
• independent exact-head frontend build, go vet, staticcheck, govulncheck and production Docker build ✅
• govulncheck reports zero reachable vulnerabilities ✅
• npm test ✅
• go test ./... ✅
• git diff --check ✅
• adversarial operator API tests, including protected-field tampering ✅
• Oracle-vs-recovery comparison completed ✅
• desktop and 390 px mobile browser QA with no horizontal overflow ✅
• 390 px More → advanced-route access verified ✅
• payment Financial drawer copy controls verified ✅
• exact built bundle browser pass with zero 4xx/5xx, console errors, page errors, or failed resources ✅
• source diff checked for temp/QA artifacts and credential markers ✅

Release note

This source gate is accepted, but the PR remains intentionally draft and targets rewrite/paygate-v2-foundation, not main. Production is untouched. Merge/deployment/cutover remain separate gated operations.