feat(connector): Finix Apple Pay Tokenize + SetupRecurring, Apple Pay & Google Pay webhooks - #2034

…oogle Pay name/address, real disabled-instrument errors

This extends commit 44b89f1 (ApplePay Tokenize + SetupMandate arm), it does
not replace it.

Fix 1: card `expiration_year` was sent verbatim, so a 2-digit year like "30"
was stored as year 30; now routed through the shared 4-digit expansion util.
New helper `get_finix_expiration_year()`; call sites in Tokenize and
SetupMandate.

Fix 2: Google Pay instrument request dropped billing `name` and `address`
(Apple Pay arm already sent them); factored into
`build_google_pay_instrument_request` mirroring the Apple Pay helper, and its
parse error now names Google Pay's own token fields.

Fix 3: `disabled_instrument_error` (now `instrument_not_usable_error`)
collapsed `enabled: false` and a missing `id` into
NO_ERROR_CODE/NO_ERROR_MESSAGE; each branch now returns a real connector code,
message and reason. Applied to both Tokenize and SetupMandate response
transformers.

Validation: cargo build clean, clippy clean, cargo fmt clean. Live-verified
against Finix sandbox: SetupRecurring(Card) -> PIi1XiiNbq2A3xF3UYrXfJrT /
CHARGED with mandateReference populated, expiry "30" stored back as 2030;
RecurringPaymentService/Charge MIT against that mandate ->
TRpxD1Z7dFpJtKkKBFbJ2GBo / CHARGED; Tokenize(Card) regression ->
PIdrr9t8dBcM3Kn5vRFA9WUH, expiry "31" stored as 2031. Apple Pay and Google Pay
SetupRecurring are structurally verified only: Finix returns 422 INVALID_FIELD
"Invalid Apple Pay token" / "Invalid Google Pay token" because it verifies the
wallet-issued signature server-side and no sandbox wallet token exists.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

… fix dispute/tags decoding, stop mis-classifying ledger transfers

Brings the Finix `IncomingWebhook` implementation to parity with the Direct
gateway and fixes four defects that made real Finix deliveries either fail to
decode or be reported as the wrong resource.

Status mapping is now canonical
* `FinixState` (webhook-only) is deleted; `FinixPaymentStatus` is the single
  deserialization source of truth for the Finix `state` field. It gains
  `#[serde(other)]` (an unmapped state no longer fails the whole body) and an
  explicit `RETURNED` variant, which is documented on `GET /transfers/{id}`.
* One `get_finix_attempt_status(state, flow, is_void)` and one
  `From<&FinixPaymentStatus> for RefundStatus` now serve Authorize, PSync,
  Capture, Void, Refund, RSync, RepeatPayment and the webhook path, so a
  webhook can no longer report a different status than a sync for the same
  connector state. `UNKNOWN` stays `Pending` everywhere instead of being a
  terminal failure on the webhook path only.

Body decoding
* `FinixDisputes.currency` is now `Option<Currency>`: Finix's Dispute resource
  has no `currency` key, so the previous required field failed decoding for
  every real dispute event and took `get_event_type` and
  `get_webhook_event_reference` down with it. The absence is reported as
  `WebhookMissingRequiredField { field: "currency" }` from the dispute builder
  only, mirroring the Direct gateway.
* `tags` is now `Option<FinixTags>` (as in Direct); an authorization event that
  omits it previously failed to decode.
* `FinixDisputeState` gains `#[serde(other)]`; `FinixEmbedded` gains the
  `Evidences` variant so the default-on `evidence.created` subscription
  degrades to "event not supported" rather than a decode failure.

Event classification and references
* Transfer handling is matched per `type` again instead of collapsing to
  "REVERSAL vs everything else". CREDIT / FEE / ADJUSTMENT / DISPUTE / RESERVE
  / SETTLEMENT and an absent `type` are platform-ledger movements: they now
  yield no event and `WebhookEventTypeNotFound` instead of being reported as a
  successful payment against the transfer id.
* The payment and refund builders reject any resource that is not an
  authorization / DEBIT transfer / REVERSAL transfer, so the shared
  dispatcher's fallback to the payment builder cannot mis-report them.

Source verification
* The signed message appends the raw body byte-for-byte instead of going
  through `String::from_utf8_lossy`, which would substitute U+FFFD before
  hashing and turn a valid signature into a mismatch.

Verified live against `EventService/ParseEvent` and `EventService/HandleEvent`
with Finix-shaped payloads: payment success/failure, refund success/failure,
dispute with and without `currency`, void, RETURNED, unknown state, settlement
transfer, evidence entity, tags omitted, endpoint-verification probe, and
signature failures (wrong key, missing header, missing sig, non-hex sig, no
secret).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

…ay webhook verification

Google Pay scope: Finix emits no wallet-specific webhook. Its webhook event
catalogue has no Google Pay entity or event type, and the `transfer`,
`authorization` and `dispute` resources carry no instrument-type
discriminator — Finix's own Google Pay guide shows a Google-Pay-originated
`POST /transfers` response that is field-for-field identical to a card
transfer, its only wallet trace being `source` pointing at a `PI…` id. The
sole place `GOOGLE_PAY` appears on the webhook surface is `instrument.type`
on the `instrument` entity, which this connector deliberately does not
model. Google Pay therefore needs no wallet-specific webhook code, and none
is added here.

Verifying that against real payloads did surface one decoding defect:

* `FinixDisputes.amount` was a required `MinorUnit`, but Finix declares
  `Dispute.amount` as `nullable: true` (OpenAPI
  `components.schemas.dispute.properties.amount`) and marks no Dispute field
  as required. A dispute delivered with `"amount": null` failed
  `FinixWebhookBody` deserialization outright and — because `FinixEmbedded`
  is untagged — took `get_event_type` and `get_webhook_event_reference` down
  with it, so the event surfaced as an undiagnosable
  `WebhookBodyDecodingFailed` with nothing pointing at the cause. It is now
  `Option<MinorUnit>`; the absence is reported as
  `WebhookMissingRequiredField { field: "amount" }` from
  `build_finix_dispute_webhook_response` only, exactly as the missing
  `currency` key already is, and no zero amount is fabricated.

Verified live against `EventService/ParseEvent` and `EventService/HandleEvent`
over gRPC with real HMAC-SHA256 `Finix-Signature` headers, using 21
Google-Pay-originated payloads built from Finix's documented webhook samples:
sale SUCCEEDED/PENDING/FAILED, authorization success and void, refund
success/failure, dispute with and without `currency`, dispute with a null
amount, RETURNED, unknown state, settlement transfer, `instrument.created`
for a GOOGLE_PAY instrument, optional fields omitted, the documented
"Authorization Captured" sample, wrong signing key, and Finix's pretty-printed
wire format signed over the exact bytes versus over re-serialized JSON.

Before this change the null-amount dispute returned "Failed to decode webhook
event body" from both entry points; it now parses to `WEBHOOK_DISPUTE_OPENED`
with the correct transfer reference and reports "Missing required field
'amount'" from HandleEvent alone.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

… webhook event type with payload status

Remediation of the independent parity audit of 44b89f1..6c8aae1.

F-2 (regression): the `get_finix_attempt_status()` unification applied
`CANCELED -> Voided` unconditionally, so a 201 `{"state":"CANCELED",
"failure_code":"card_expired"}` on Authorize/Capture/PSync/RepeatPayment stopped
being a payment failure. `is_payment_failure(Voided)` is false, so the
transformer returned `Ok(TransactionResponse)` instead of
`Err(ErrorResponse{code:"card_expired"})` and dropped the decline reason. Move
`CANCELED -> Voided` inside the `is_void == Some(true)` branch; outside a void it
joins FAILED/RETURNED. `UNKNOWN -> Pending` and the PENDING-void -> Pending
correction are kept, and Void/Refund/RSync stay byte-identical to 45351c2.

F-1 (regression): `get_finix_webhook_event_type` was left on the old grouping
while the content status mapping was unified, so a successful void
(is_void:true, CANCELED) emitted `PaymentIntentCancelFailure` carrying a `Voided`
payload. The payment arms now derive their event type from
`get_finix_attempt_status` via `get_finix_webhook_payment_event_type`, which makes
agreement structural. DEBIT transfers now honour `is_void` for the same reason.
`UNKNOWN` keeps emitting no event (a non-assertion, so it cannot contradict).

F-3: `FinixWebhookPaymentsResponse.amount`/`.currency` are required but never
read, and `FinixEmbedded` is `#[serde(untagged)]`, so one missing key collapsed the
whole body decode and took get_event_type, get_webhook_event_reference and
get_webhook_resource_object down with it. Now `Option<T>` + `#[serde(default)]`,
matching what was already done for `tags`. Same treatment for the equally unread
`FinixAuthorizeResponse.amount`/`.currency`.

F-9: `get_finix_expiration_year("203")` returned `Ok(203)` and sent
`expiration_year: 203`; `get_expiry_year_4_digit()` only expands two-digit input.
Non-four-digit years are now rejected with the existing typed `InvalidDataFormat`.

F-8: delete the dead `impl From<&FinixPaymentStatus> for AttemptStatus`, which
hardcoded `FinixFlow::Transfer` and would have silently produced `Charged` in an
authorization context.

F-4 (NOT fixed — needs a core change): `process_dispute_webhook` hard-errors on
`dispute.currency`, which the Finix `dispute` schema does not define, so a merchant
is never notified of a chargeback. It cannot be fixed in connector scope:
`process_dispute_webhook` takes no `EventContext`, `EventContext` carries only
`capture_method`, and the proto `DisputeEventContext` is empty. Fabricating a
currency is not acceptable, so the failure is documented in place and the error
switched to `WebhookMissingRequiredContext`, which names the actual gap.

Adds the first finix tests: a table-driven (flow, state, is_void) -> AttemptStatus
matrix, an event-type/status agreement property test, and expiry-year boundaries.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Adds 36 verified Finix documentation URLs (webhooks, wallets, payment
instruments, recurring) discovered during the ApplePay/GooglePay flow
work. Additive only; no existing entries modified.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>