feat(bank): activate Bank Frick payout accounts (prd data migration)

[TaprootFreak]

Production data migration that activates the two new Bank Frick payout accounts, per docs/bank-frick-operations.md section 3.

What it does (prd only)

Guarded to ENVIRONMENT === 'prd' — a complete no-op on dev/loc/CI (there the Bank Frick registry comes from migration/seed/bank.csv). On prd it:

• Inserts the two new Bank Frick rows (EUR/CHF) active (receive=true, send=true, sctInst=false, sendPriority=500), idempotent per IBAN (WHERE NOT EXISTS).
• Renames the dormant legacy Bank Frick rows to Bank Frick (legacy) (§3.2) so (name, currency) no longer collides.
• Seeds lastBankFrickDate:<bankId> per new row (§1) so polling starts at now, not epoch.
• Removes the two default-off Frick process sentinels from disabledProcess — exactly the inverse of 1783944000000's seed, preserving any unrelated entries.

down() reverses every step, guarded the same way.

Routing

sendPriority=500 makes Frick the primary sender for EUR and CHF (below the incumbents' backfilled 1000), so new EUR+CHF payouts route to Frick. Set 2000 for fallback-only. Never 1000 — a top-priority tie that includes Frick is treated as misconfiguration and throws in getPayoutAccount.

Deliberate deviation from the manual-registry convention

§3 documents these as manual production steps and 1783944000000 intentionally never touches bank rows. Encoding them here is a deliberate decision for this activation; the migration is prd-guarded and fully idempotent so it cannot double-apply. The §6 sandbox checklist is handled operationally as part of this rollout, with the credential chain verified live on the first inbound poll after deploy.

Verification

Because the SQL is prd-guarded, CI does not exercise it — so it was validated directly against Postgres 17 with a prod-shaped fixture (legacy Frick rows + Olkypay/Yapeal): up() yields the two active rows, renames the three legacy rows, seeds both watermarks, strips only the two Frick sentinels (unrelated preserved), and leaves Olkypay/Yapeal untouched; down() reverses cleanly. node --check passes.

Activation

Merging + deploying this, together with enabling the payout flag in the deployment config, arms the Frick outbound rail. The first inbound poll after deploy is the live credential check; a bad credential fails closed (payouts remain pending, no funds move).

[TaprootFreak]

Ready-review preparation complete: 8 review passes (conformity + logic) iterated to zero findings.

Key changes made across the passes:

• English-only comments (public repo).
• Kept the runbook §3.1 named sequence bank_id_seq for the setval instead of pg_get_serial_sequence('bank','id') — the latter returns NULL (and setval(NULL,...) crashes this prd-only migration on boot) if the post-cutover production sequence is not OWNED BY the column; restored the GREATEST guard so the sequence only ever moves forward.
• Row inserts use INSERT ... ON CONFLICT (iban,bic) DO UPDATE so a row pre-created inactive by the manual §3.1 procedure converges to the active state rather than silently no-op'ing.
• Documented the down() rollout assumption and its intentional lossy hard-removal on the pre-created path.

Because the SQL is ENVIRONMENT === 'prd'-guarded, CI does not exercise it, so it was validated directly against Postgres 17 with a production-shaped fixture: fresh insert, pre-existing-inactive convergence, idempotent re-run, and down() reverse all pass.