feat: blockchain reorganization detection for transaction confirmations (#514)

[primexk5]

What this PR does

• Implements blockchain reorganization detection per issue Security: Implement Blockchain Reorganization Detection for Transaction Confirmations #514
• Adds ConfirmationTracker — per-network in-memory tracking with configurable safety thresholds (Ethereum=12, Polygon=64, Stellar=1, env-overridable via CONFIRMATION_THRESHOLD_*)
• Adds ReorgDetector — polls EVM chains via ethers.js JsonRpcProvider and Stellar via Horizon REST API; detects parentHash mismatches and same-height sibling blocks; atomically persists ReorgEvent + TransactionReorg rows via prisma.$transaction; marks affected payments pending_review; enqueues BullMQ re-verification jobs (5× exponential backoff); fires webhook alerts when depth exceeds safety threshold
• Adds REST routes (GET /api/v1/chain/reorgs, /dashboard, /history, /:id, POST /simulate) all protected by verifyInternalSignature HMAC middleware
• Adds ReorgEvent and TransactionReorg Prisma models + pending_review payment status

Changes

• backend/prisma/schema.prisma — new ReorgEvent, TransactionReorg models; pending_review payment status
• backend/src/services/chain/confirmation-tracker.ts — new file
• backend/src/services/chain/reorg-detector.ts — new file
• backend/src/routes/reorg.ts — new file (5 routes)
• backend/src/index.ts — wired up router and detector lifecycle
• backend/src/services/chain/__tests__/reorg-detector.test.ts — 20 unit tests

Why

Resolves all acceptance criteria from issue #514: reorg detection service, confirmation tracker, Prisma models, BullMQ queue for re-verification, dashboard routes, and integration tests.

How to test

cd backend
npm run db:generate
npx vitest run src/services/chain/__tests__/reorg-detector.test.ts
# 20/20 tests should pass

For manual testing, POST to /api/v1/chain/reorgs/simulate with a valid x-internal-signature header in dev mode.

Notes

• Stellar uses Horizon REST API, not EVM JSON-RPC (separate provider)
• prisma.$transaction() ensures atomic writes across ReorgEvent + TransactionReorg + Payment
• start() is idempotent — safe to call multiple times

Closes #514

[vercel]

@primexk5 is attempting to deploy a commit to the smartdevs17's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@primexk5 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Smartdevs17]

⚠️ Merge failed — could not merge.

Possible reasons:

• CI checks not passing
• Branch protection rules
• Other merge requirements not met

---

🤖 Drips Wave Merge Agent

[Smartdevs17]

⚠️ Merge failed — could not merge.

Possible reasons:

• CI checks not passing
• Branch protection rules
• Other merge requirements not met

---

🤖 Drips Wave Merge Agent

[Smartdevs17]

❌ This PR has merge conflicts with main.

Hi @primexk5, please resolve the conflicts so this can be merged.

---

🤖 Drips Wave Merge Agent

[primexk5]

Hey @Smartdevs17 , the merge conflict has been resolved. Here's a summary of what was done:

Root cause: The branch was based on an older ancestor of main — commit 1f0a353 (#535: cross-tenant isolation, slippage protection, sliding-window rate limiting) had since landed on main and touched overlapping files (backend/src/index.ts, package-lock.json).

Fixes applied:

1. ✅ Rebased onto main — replayed the commit cleanly on top of the latest main with no conflicts (changes were in separate code areas)
2. ✅ Restored devDependencies ordering in backend/package.json to match main's style, so the diff is minimal and only contains the legitimate new optionalDependencies block
3. ✅ Regenerated package-lock.json to stay in sync with the updated package.json
4. ✅ Force-pushed the cleaned-up commit to the branch

The PR now has a single clean commit sitting directly on top of main, with only the 7 files that are genuinely part of the blockchain reorg detection feature. It should be ready for re-review. 🙏

[Smartdevs17]

Merge conflicts

[primexk5]

@Smartdevs17 merge conflicts resolved

[Smartdevs17]

Merged please kindly leave a review