fix: exact batch totals, payout retry worker and webhook hardening (#1163-#1166)

[UltimateUser1]

Summary

Delivers the next increment of four templated iteration issues. Each issue takes one concrete, verifiable problem rather than a broad sweep, so every change stays independently reviewable.

Closes #1163
Closes #1164
Closes #1165
Closes #1166

Scope

#1164 - Fix payment correctness bugs

• estimateBatch and getBatchReport summed amounts with parseFloat, so totals drifted with binary floating point. They now use sumAmounts (exact decimal, 7 dp).
• estimateBatch summed XLM and USDC into one totalAmount. The total is now null unless the batch spans exactly one asset. byAsset is unchanged.

#1165 - Improve payout reliability

• retryDueBatches() existed, and failures recorded a backoff timestamp, but nothing called the retry pass automatically. Failed batches waited until an operator hit POST /api/v1/payouts/retries.
• New startPayoutRetryWorker() (backend/src/services/payouts/retry-worker.ts) runs the pass on an interval (60s). Passes never overlap, the timer is unref'd, and a rejected pass is logged and retried on the next tick.
• Started from the deferred-startup block in backend/src/index.ts.

#1166 - Strengthen payment security

• Webhook verification: an unparseable timestamp produced NaN in the tolerance check, and NaN > tolerance is false, so it passed the replay window. It is now rejected.
• The hand-rolled string comparison for webhook digests is replaced with crypto.timingSafeEqual over the decoded bytes. Non-hex or wrong-length signatures fail closed.

#1163 - Improve documentation

• docs/PAYMENT_CORRECTNESS.md: new section on exact batch totals and per-asset totals.
• WEBHOOK_VERIFICATION.md: new section on the replay window and signature comparison.
• docs/PAYOUT_RELIABILITY.md already describes the retry worker as "driven by a scheduled worker"; that statement is now accurate.

Files

File	Change
backend/src/services/batch.ts	exact per-asset sums, single-asset total
backend/src/services/webhooks/verification.ts	invalid-timestamp rejection, timingSafeEqual
backend/src/services/payouts/retry-worker.ts	new - interval driver for retryDueBatches
backend/src/index.ts	start the retry worker after listen
backend/src/services/payouts/__tests__/retry-worker.test.ts	new
backend/src/services/webhooks/__tests__/verification.test.ts	replay and signature hardening tests
docs/PAYMENT_CORRECTNESS.md, WEBHOOK_VERIFICATION.md	documentation

Testing

• backend/src/services/__tests__/batch.test.ts already asserts the single-asset and mixed-asset total contract that this change implements.
• New tests cover interval scheduling, stop, overlap skipping, error recovery in the retry worker, invalid timestamps, non-hex signatures, and single-byte signature tampering.
• Run locally: cd backend && npm run lint && npm test. Not executed in the authoring environment, so CI is the first run for these files.

[vercel]

@QueenGiba is attempting to deploy a commit to the smartdevs17's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@UltimateUser1 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits