feat(backend): implement exponential backoff retry, distributed locking, payload sanitization & integration tests

[kingsebuks001]

Summary

This PR resolves 4 backend issues targeting the Fraud Detection Engine and Audit Circuit Breaker modules.

---

Changes

Closes #1429 — Exponential Backoff Retry in Fraud Detection Engine

• Added isTransientError(err) to classify retryable errors (network errors, HTTP 429/503/5xx)
• Added executeWithRetry(fn, options) with configurable maxRetries (default 3), baseDelayMs (200ms), maxDelayMs (5s), and ±20% jitter
• Retries only on transient failures; throws immediately on non-transient errors
• Logs each retry attempt with attempt number, delay, and error message
• Integrated into the fraud check pipeline wrapping Redis/DB calls

Closes #1430 — Distributed Concurrency Control and Locking for Fraud Detection Engine

• Added LockTimeoutError class for clean error handling on lock acquisition timeout
• Added acquireLock(key, ttlMs, redis) using Redis SET NX EX with namespaced keys (fraud:lock:{id})
• Added releaseLock(lockKey, token, redis) using atomic Lua compare-and-delete to prevent accidental release
• Added withLock(key, ttlMs, fn, redis, opts) convenience wrapper — polls until acquired (3s timeout, 50ms interval), always releases in finally
• Added analyzePaymentLocked() wrapping core evaluation in withLock + executeWithRetry

Closes #1432 — Payload Sanitization and Strict Validation for Audit Circuit Breaker

• Added ValidationError class carrying field and reason properties
• Added sanitizePayload(payload) — allowlist filtering (18 permitted fields), string truncation >1000 chars, prototype pollution blocking (__proto__/constructor/prototype), sensitive field redaction ([REDACTED])
• Added validatePayload(payload) — enforces event, timestamp, merchantId with strict regex and type checks
• Added AuditCircuitBreaker.process(rawPayload, handler) entry point running sanitize → validate before any circuit logic
• All original CLOSED/OPEN/HALF_OPEN circuit breaker logic fully preserved

Closes #1431 — Comprehensive Integration and Stress Test Suite for Fraud Detection Engine

• Created backend/tests/integration/fraud-detection-integration.test.js — 22 test cases
• Covers: retry success/failure/non-transient bypass, exponential delays, jitter, lock acquire/timeout/release/cleanup, 5 concurrent serialized calls, 50 sequential stress, 20 concurrent stress
• Covers: sanitizePayload, validatePayload, full integration pipeline (malicious payload rejection, valid event passthrough)
• Pure Jest, inline fake Redis — zero real connections, no new dependencies

---

Files Changed

File	Change
backend/src/lib/fraud-detection-engine.js	Added retry + distributed locking
backend/src/lib/audit-circuit-breaker.js	Added sanitization + validation
backend/tests/integration/fraud-detection-integration.test.js	New — 22 integration/stress tests
.gitignore	Added *.snap, __snapshots__/, output files, logs, .codex

---

Security Notes

• Lock tokens are cryptographically random UUIDs — no predictable lock stealing
• Lua atomic release prevents TOCTOU race on lock release
• Prototype pollution blocked at sanitization layer before any field access
• Sensitive fields redacted before audit log persistence

[drips-wave]

@kingsebuks001 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[vercel]

@kingsebuks001 is attempting to deploy a commit to the Emmanuel's projects Team on Vercel.

A member of the Team first needs to authorize it.