Add payment authorization freshness guard

[haki203]

@algora-pbc /claim #20

Summary

Adds a distinct payment-authorization-freshness-guard/ slice for issue #20.

The guard evaluates saved payment instruments and customer authorizations before subscription renewals, AI compute top-ups, analytics license renewals, or institutional auto-pay charges are attempted. It checks:

• expired saved cards
• stale SCA/3DS mandates
• missing ACH/direct-debit mandate evidence
• mandate scope mismatches by revenue stream
• missing autopay consent
• amount variance without customer notice
• currency variance without customer notice
• unsafe charge release holds before revenue or cash is posted

It emits deterministic JSON, Markdown, SVG, and MP4 reviewer artifacts from synthetic data only.

Non-overlap

This is not another generic billing ledger, usage metering module, payment rail failover guard, payment webhook replay guard, collections or AR aging guard, dispute module, tax guard, FX settlement guard, plan-proration module, procurement control, invoice acceptance gate, storage overage guard, account-transfer guard, prepaid credit breakage guard, analytics API/seat roster guard, compute idempotency guard, or customer-consolidation guard.

It focuses specifically on whether the saved payment authorization is fresh enough to attempt a charge.

Validation

• npm --prefix payment-authorization-freshness-guard test -> 4 tests passed
• npm --prefix payment-authorization-freshness-guard run check -> syntax checks passed
• npm --prefix payment-authorization-freshness-guard run demo -> generated JSON/Markdown/SVG artifacts
• npm --prefix payment-authorization-freshness-guard run video -> generated reports/demo.mp4
• ..\..\node_modules\ffmpeg-static\ffmpeg.exe -v error -i payment-authorization-freshness-guard\reports\demo.mp4 -f null NUL -> MP4 decoded without errors
• git diff --check and git diff --cached --check -> passed
• Sensitive-pattern scan over payment-authorization-freshness-guard returned no matches

Safety

Synthetic data only. No live customer data, card numbers, bank details, payment processors, credentials, external APIs, payment movement, payout systems, or network calls are used.

AI-assisted with OpenAI Codex; I reviewed and locally verified the diff before submitting.