[favour-GL]

Summary

Improve security, observability, and reliability across encryption key rotation, event storage, privacy erasure, transaction recovery, and referral reward processing.

Changes

• Encryption monitoring: Add metrics and production alerting when the legacy encryption key is used as a fallback, and document the behavior in the key rotation runbook.
• Test coverage: Add unit tests for event store trimming and sequence semantics, consent middleware, data mapping, audit-anchor stubs, and bridge behavior, plus a database-backed privacy erasure integration test to verify real cascade behavior.
• Outbox transaction recovery: Preserve transaction hashes until terminal resolution, reconcile timed-out transactions before resubmission, and add regression coverage to prevent duplicate payments after timeout-then-failure scenarios.
• Referral reward idempotency: Include transaction.id in referral reward idempotency keys to ensure corrected payouts are enqueued instead of silently reusing previously confirmed operations, with regression tests.

Testing

• Verify legacy key usage triggers the expected metrics.
• Validate event storage, consent enforcement, and privacy erasure behavior.
• Test transaction timeout recovery and confirm no duplicate payments occur.
• Verify corrected referral rewards generate distinct outbox operations.

Closes #697
Closes #694
Closes #657
Closes #658