feat(card): surface Didit duplicate-filter review reasons on /card/activate (qa)

[MusabShakeel576]

Summary

Cherry-pick of #2090 onto qa.

Didit's new duplicate IP and duplicate device filters are configured to send suspicious applicants to In Review (so they don't reach Rain). The backend already maps that to kycStatus: UNDER_REVIEW and persists the warnings on cardCustomer.diditWarnings, but step 1 of /card/activate returned a fixed generic copy regardless. This surfaces the actual reason.

• Adds DUPLICATED_IP / DUPLICATED_DEVICE to DIDIT_WARNING_DESCRIPTIONS and tightens POSSIBLE_DUPLICATED_USER wording.
• getStepDescription UNDER_REVIEW branch renders the warnings list when any are present; falls back to the original "takes a few minutes" copy when warnings are empty.

Button stays "Under Review" + disabled — applicants wait for the reviewer's decision; we don't pre-judge a duplicate as fraud.

Test plan

• Trigger a Didit session that hits the duplicate IP filter → backend webhook stores kycStatus: UNDER_REVIEW with DUPLICATED_IP in kycWarnings.
• Land on /card/activate?kycStatus=under_review; verify step 1 description renders:

  Your application is under additional review:
  - This network has already been used to verify another account
  
  We'll update you when the review is complete.
  

• Same flow with duplicate device → reads "This device has already been used to verify another account".
• UNDER_REVIEW without warnings (manual review with no surfaced reasons) still shows "Your information is being reviewed. This usually takes a few minutes."
• Step-1 button stays "Under Review" and disabled in all the above.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
solid-app	Ignored		May 24, 2026 1:41pm
solid-app-staging	Ignored		May 24, 2026 1:41pm