Standardize wallet limits, error envelope, and Prisma migration hygiene

[Dannyswiss1]

Summary

Closes #502
Closes #503
Closes #514
Closes #523.

#502 — Replace legacy user limits with wallet scoped limits

• Verified WalletLimit (Prisma model), LimitsService, and LimitsController already implement full wallet-scoped CRUD with soft-delete, domain events, metrics, and OpenAPI docs; legacy UserLimit/LegacyUser are unreferenced outside schema.prisma.
• Fixed limits.controller.ts referencing UpdateLimitsDto in a @ApiBody decorator without importing it — a ReferenceError that crashed the module at load time.
• Fixed payments-limits.integration.spec.ts, which failed to instantiate PaymentsService because PaymentMetricsService/ConfigService providers were never added after those constructor deps were introduced.
• Rewrote stale assertions in limits.service.spec.ts that no longer matched the real implementation (asserted hard delete instead of soft-delete, referenced an undefined cacheService, missing transaction.findMany mocks for remainingDailyLimit).

#503 — Create spending limits with Prisma transactions

• LimitsService.setLimits now wraps its read-then-write (findUnique + upsert) in a single prisma.$transaction(...), closing a race window where two concurrent setLimits calls for the same wallet could read the same "existing" state and emit incorrect limit.updated diffs.
• Added tests: transaction invoked exactly once per call, and a transaction failure propagates with zero events emitted.
• Updated OpenAPI description on POST /wallets/:walletId/limits to document the atomicity guarantee.

#514 — Standardize structured API error responses

• The fully-built, fully-tested HttpExceptionFilter was never registered — no app.useGlobalFilters() call existed anywhere, so real requests bypassed it entirely. Wired it into main.ts.
• Fixed a contract gap: the filter dropped errorCode from exception bodies (e.g. LimitExceededException's LIMIT_PER_TX_EXCEEDED) even though the limits controller's own OpenAPI examples document it. Added errorCode to ErrorResponse and the parsing logic.
• Documented the standardized error envelope shape in README.md.

#523 — Normalize Prisma migration docs and CI check

• Found prisma/migrations/network_scoped_api_keys.sql sitting as a loose file directly under prisma/migrations/ — Prisma silently ignores anything not inside a migration folder, so the ApiKey.network column already declared in schema.prisma had no migration that actually created it (and the stray file used the wrong type, TEXT instead of the WalletNetwork enum). Moved it into a proper 20260730000000_add_network_scoped_api_keys/migration.sql with the corrected enum type.
• Added scripts/check-migration-naming.ts: validates no loose files besides migration_lock.toml, every folder has a migration.sql, names match <14-digit-timestamp>_<snake_case>, and no duplicate timestamps — with a documented LEGACY_EXCEPTIONS allowlist for pre-existing folders already applied to real databases.
• Wired the check into CI (.github/workflows/ci.yml), plus a scoped Jest config (scripts/jest.config.js) for the checker's own unit tests.
• Added docs/PRISMA-MIGRATIONS.md documenting the convention.

Test plan

• pnpm test — all touched suites pass (limits.service.spec.ts, limits.controller.spec.ts, payments-limits.integration.spec.ts, http-exception.filter.spec.ts)
• pnpm run test:scripts — 8/8 passing for the new migration-naming checker
• pnpm run prisma:check-migrations — passes against current repo state
• npx prisma validate — schema valid
• tsc --noEmit clean on all touched files

[drips-wave]

@Dannyswiss1 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits