feat(admin): manual full-order refund + ledger CSV export

Closes the admin / reports / catalog work. Each fund row on the /_gm finance panel gains a Refund action (payments.RefundOrderFull): a full-order refund the operator records after refunding on the rail — a refund ledger row + a floor-0 chip revoke (never negative, D27), idempotent (a second refund reports already-refunded). A ledger CSV export (/_gm/ledger.csv, payments.LedgerExport) streams the whole append-only ledger for tax + reconciliation. Tests: refund an order in full (chips revoked, a refund row), an idempotent second refund, the CSV export shape; CSRF-guarded.
2026-07-10 06:46:18 +02:00
parent ec5c6afa23
commit 1bf612a087
8 changed files with 242 additions and 13 deletions
@@ -150,7 +150,11 @@ backed by the FK); a `tournament`-bearing product is composable but not sellable
 also carries an admin **grant** panel: grant raw benefit atoms (hints / no-ads days / forever) or a
 defined **value product** (a reward bundle, including an archived one), origin-picked; both write an
 `admin_grant` ledger row via `payments.Grant` / `GrantProduct` and **refuse** a chips or `tournament`
-atom (never grant currency; no tournament target yet). The shared wire
+atom (never grant currency; no tournament target yet). Each fund row in the panel carries a **Refund**
+action (`payments.RefundOrderFull`): a full-order refund the operator records after refunding on the
+rail — a `refund` ledger row + a floor-0 chip revoke, idempotent. A **ledger CSV export**
+(`/_gm/ledger.csv`, `payments.LedgerExport`) dumps the whole append-only ledger for tax +
+reconciliation. The shared wire
 contracts live in the sibling [`../pkg`](../pkg) module.

 **Account linking & merge** (`/api/v1/user/link/*`). `internal/link`