feat: web vitals, KYC enforcement, sanctions screening, AML monitoring

[Good-Coded]

Summary

closes #499 — Web Vitals endpoint**

• Added POST /api/analytics/web-vitals (stores name, value, rating, navigationType, url, timestamp)
• Added GET /api/analytics/web-vitals/dashboard returning p75 LCP/INP/CLS/FCP/TTFB (auth-gated)
• Updated frontend/src/utils/webVitals.ts to send metrics via navigator.sendBeacon (falls back to fetch)

closes #500 — KYC enforcement**

• Added backend/src/middleware/kyc.js (requireKYC): blocks payments above KYC_LARGE_TRANSACTION_LIMIT (default 1000 XLM) unless the sender has APPROVED KYC; returns 403 { error: 'KYC_REQUIRED', kycStatus }
• Applied middleware to POST /api/stellar/payment/send
• Frontend confirmPayment now catches KYC_REQUIRED from the backend and opens the KYC form

closes #501 — Sanctions screening**

• Rewrote sanctionsChecker.js to call the OFAC-API (configurable via SANCTIONS_API_KEY / SANCTIONS_API_URL)
• Screens sender and recipient on every payment before submitting to Stellar; returns 403 SANCTIONS_HIT on a match
• Gracefully degrades (warn + pass) when no API key is configured

closes #502 — AML monitoring**

• Rewrote amlMonitor.js with configurable rules: LARGE_TX, STRUCTURING (>3 sub-threshold txs in 24 h), VELOCITY (24 h total > $10k), UNVERIFIED_USER
• Persists AMLAlert records to the database for each triggered rule
• GET /api/compliance/aml-alerts (admin only) already existed and now returns real DB data

Config

New env vars documented in backend/.env.example and backend/CONFIGURATION.md:
SANCTIONS_API_KEY, SANCTIONS_API_URL, SANCTIONS_MIN_SCORE, KYC_LARGE_TRANSACTION_LIMIT, AML_LARGE_TX_THRESHOLD, AML_STRUCTURING_THRESHOLD, AML_STRUCTURING_COUNT, AML_VELOCITY_LIMIT

Tests

Unit/integration tests added in backend/tests/issues-499-502.test.js covering all four features.

[drips-wave]

@Good-Coded Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits