a70276af - Add compliance screen for chargebacks awaiting manual approval

[TaprootFreak]

Why

Chargebacks the automatic release jobs cannot promote wait indefinitely, and since the external tracking sheet was retired nobody sees them — the backlog is invisible and refunds sit unprocessed for weeks. The API side merged as DFXswiss/api#4729: GET /support/pending-chargebacks (role COMPLIANCE) lists every stuck case with the reason(s) the automatic job cannot release it, oldest customer request first.

What

A compliance list screen making that backlog actionable, following the compliance-recall-list pattern:

• DTO src/dto/chargeback.dto.ts — mirrors the API response (ChargebackBlockReason, PendingChargebackEntry).
• Hook — getPendingChargebacks() in compliance.hook.ts, same mechanics as getRecalls().
• Screen compliance-chargeback-list.screen.tsx — guarded by useComplianceGuard(); columns: requested date, transaction, customer, input, chargeback, block reasons, names. The API's oldest-first order is kept, no client-side sort. Loading, error and loaded content render mutually exclusively.
• Row semantics that matter:
  • NameMismatch rows show verifiedName / completeName / creditorName side by side on one line — that is the data the clerk decides on, visible without leaving the list.
  • UserNotReleased rows are visually distinct (yellow row, red badge): blocked or risk-flagged customers must not be waved through casually.
  • chargebackDate is a safety sentinel and must always be empty here; if it is ever populated, the row turns red with an explicit error marker instead of hiding the inconsistency.
  • Each row links to the existing approval screen at compliance/bank-tx/{txId}/return (transaction id, not entity id).
• Route compliance/pending-chargebacks + sitemap entry.

Tests & handbook

• Unit tests bring the screen to 100% statement/branch/function/line coverage and pin the hook contract (support/pending-chargebacks, GET). The DTO file measures 0% like every sibling DTO file (repo-wide measurement artifact, e.g. recall.dto.ts).
• Playwright spec e2e/compliance-chargeback-list.spec.ts with synthetic fixtures (real admin auth, mocked endpoint) plus committed chromium-darwin baselines for the loaded list (all row variants incl. the sentinel) and the empty state; handbook metadata entry compliance-chargeback-list.
• Warning styles use the repo's real Tailwind palette (dfxRed/dfxYellow) — the default-palette classes do not exist in this config.

Notes

• Requires the API endpoint to be deployed; until then the list errors (401/404).
• No new dependencies, no non-null assertions (the widget build is strict about them).

Closes #1278

[TaprootFreak]

Three review passes to zero findings.

Fixed along the way: the NAME_MISMATCH name triple no longer wraps onto separate lines; loading, error and loaded content now render mutually exclusively (a failed fetch no longer shows the empty-state text next to the error); the warning styles moved onto the palette this repo actually generates — bg-red-100/bg-yellow-50/text-red-800 do not exist in our Tailwind config and rendered no color at all (pre-existing uses of those classes elsewhere carry the same dormant issue and are untouched here); unit tests bring the screen to full coverage; a Playwright spec, committed baselines and a handbook metadata entry cover the new screen.

One conformity note, resolved as out of scope: getPendingChargebacks() uses the hook file's local call<T>() pattern rather than an SDK method. The endpoint is not in the installed SDK, and all 45 existing functions in compliance.hook.ts — including getRecalls(), which this feature is modeled on — use the identical local pattern. Moving compliance endpoints onto the SDK is the subject of the dedicated refactor series (#1239–#1243); this PR follows its siblings until that lands.

[TaprootFreak]

One note from a later read-through: the unit tests mock the API payload with Date instances (compliance-chargeback-list.screen.test.tsx:45, compliance-pending-chargebacks.hook.test.ts:59-60), but over JSON transport these fields arrive as ISO strings. The rendering path handles both today, yet the tests would stay green through a regression that only breaks on string input — worth switching the mocks to ISO strings to match the real response shape.