feat: four super-admin keys and production customer API security

Co-authored-by: Cursor <cursoragent@cursor.com>

services/settlement-middleware/src/middleware/auth.ts

@@ -0,0 +1,18 @@
+import type { Request, Response } from 'express';
+import { resolveOmnlPrincipal } from '@dbis/integration-foundation';
+import { loadConfig } from '../config';
+
+export function requireApiKey(req: Request, res: Response): boolean {
+  const cfg = loadConfig();
+  if (!cfg.production.requireApiKey) return true;
+  const principal = resolveOmnlPrincipal(req);
+  if (!principal) {
+    res.status(401).json({ error: 'Unauthorized' });
+    return false;
+  }
+  if (principal.role === 'customer') {
+    res.status(403).json({ error: 'Forbidden', hint: 'Settlement APIs require super-admin credentials' });
+    return false;
+  }
+  return true;
+}

services/settlement-middleware/src/middleware/rate-limit.ts

@@ -0,0 +1,24 @@
+import rateLimit from 'express-rate-limit';
+import type { RequestHandler } from 'express';
+import { isProductionSecurityMode, loadCustomerSecurityPolicy, resolveOmnlPrincipal } from '@dbis/integration-foundation';
+
+function asHandler(h: ReturnType<typeof rateLimit>): RequestHandler {
+  return h as unknown as RequestHandler;
+}
+
+export const settlementRateLimiter = asHandler(
+  rateLimit({
+    windowMs: 60_000,
+    max: (req) => {
+      if (!isProductionSecurityMode()) return 200;
+      const policy = loadCustomerSecurityPolicy();
+      const principal = resolveOmnlPrincipal(req);
+      if (!principal) return policy.rateLimits.anonymousPerMinute;
+      if (principal.role === 'customer') return policy.rateLimits.customerPerMinute;
+      return policy.rateLimits.superAdminPerMinute;
+    },
+    message: { error: 'Too many requests — rate limit exceeded' },
+    standardHeaders: true,
+    legacyHeaders: false,
+  }),
+);