feat: blockchain reorganization detection for transaction confirmations (#514)

[primexk5]

What this PR does

• Implements blockchain reorganization detection per issue Security: Implement Blockchain Reorganization Detection for Transaction Confirmations #514
• Adds ConfirmationTracker — per-network in-memory tracking with configurable safety thresholds (Ethereum=12, Polygon=64, Stellar=1, env-overridable via CONFIRMATION_THRESHOLD_*)
• Adds ReorgDetector — polls EVM chains via ethers.js JsonRpcProvider and Stellar via Horizon REST API; detects parentHash mismatches and same-height sibling blocks; atomically persists ReorgEvent + TransactionReorg rows via prisma.$transaction; marks affected payments pending_review; enqueues BullMQ re-verification jobs (5× exponential backoff); fires webhook alerts when depth exceeds safety threshold
• Adds REST routes (GET /api/v1/chain/reorgs, /dashboard, /history, /:id, POST /simulate) all protected by verifyInternalSignature HMAC middleware
• Adds ReorgEvent and TransactionReorg Prisma models + pending_review payment status

Changes

• backend/prisma/schema.prisma — new ReorgEvent, TransactionReorg models; pending_review payment status
• backend/src/services/chain/confirmation-tracker.ts — new file
• backend/src/services/chain/reorg-detector.ts — new file
• backend/src/routes/reorg.ts — new file (5 routes)
• backend/src/index.ts — wired up router and detector lifecycle
• backend/src/services/chain/__tests__/reorg-detector.test.ts — 20 unit tests

Why

Resolves all acceptance criteria from issue #514: reorg detection service, confirmation tracker, Prisma models, BullMQ queue for re-verification, dashboard routes, and integration tests.

How to test

cd backend
npm run db:generate
npx vitest run src/services/chain/__tests__/reorg-detector.test.ts
# 20/20 tests should pass

For manual testing, POST to /api/v1/chain/reorgs/simulate with a valid x-internal-signature header in dev mode.

Notes

• Stellar uses Horizon REST API, not EVM JSON-RPC (separate provider)
• prisma.$transaction() ensures atomic writes across ReorgEvent + TransactionReorg + Payment
• start() is idempotent — safe to call multiple times

Closes #514

[vercel]

@primexk5 is attempting to deploy a commit to the smartdevs17's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@primexk5 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits