feat: paginate manual-review queue, runtime websocket CORS, recon metrics and transition logging

[hikmat67-code]

Summary

Payments module quality + observability fixes.

• Manual-review list returns every payment with no pagination #1944 Paginate the manual-review queue — the admin manual-payment-review endpoint returns a bounded, paginated page (limit/offset with a max page size) instead of loading every pending payment at once.
• Payments websocket gateway reads FRONTEND_URL at import time and ignores CORS_ORIGINS #1943 Runtime-configurable websocket CORS — a custom WsCorsIoAdapter applies the CORS origins from config to the Socket.IO gateway at runtime, and it is installed in main.ts before the websocket module is initialised (installing it later has no effect).
• Reconciliation never emits the mismatch-count metric; helper is unused #1942 Reconciliation mismatch metric — reconciliation mismatches now increment a dedicated Prometheus counter with the appropriate labels instead of being only logged.
• Rejected payment state transitions are thrown but never logged #1941 Payment state-transition logging — state transitions are recorded through a structured helper that persists an auditable record (replacing the previous fire-and-forget logging), with tests covering the allowed/blocked transitions.

Verification

• npx jest src/common/ws-cors.io-adapter.spec.ts src/payments (gateway, reconciliation, state machine, admin, metrics) → 6 suites / 157 tests passing.
• npx tsc --noEmit on the frontend shows only the pre-existing errors.

Issues

Closes #1944
Closes #1943
Closes #1942
Closes #1941

[vercel]

@hikmat67-code is attempting to deploy a commit to the naijabuz's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@hikmat67-code Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits