feat(cards): import Marqeta Malta EU production card issuing

Add Core API adapter, card-issuer hub routes, webhook sink, TA issue path, smoke script, and portal status UI with fail-closed live gate.

Co-authored-by: Cursor <cursoragent@cursor.com>

scripts/rails/smoke-marqeta-malta.mjs

@@ -0,0 +1,87 @@
+#!/usr/bin/env node
+/**
+ * Smoke-test Marqeta Malta credentials.
+ * Loads secrets/marqeta/credentials.env then process.env.
+ * Usage: node scripts/rails/smoke-marqeta-malta.mjs
+ */
+import fs from 'fs';
+import path from 'path';
+import { fileURLToPath } from 'url';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const root = path.resolve(__dirname, '../..');
+
+function loadEnvFile(rel) {
+  const p = path.join(root, rel);
+  if (!fs.existsSync(p)) return {};
+  const out = {};
+  for (const line of fs.readFileSync(p, 'utf8').split(/\r?\n/)) {
+    if (!line || line.trim().startsWith('#')) continue;
+    const i = line.indexOf('=');
+    if (i < 0) continue;
+    out[line.slice(0, i).trim()] = line.slice(i + 1).trim().replace(/^["']|["']$/g, '');
+  }
+  return out;
+}
+
+function applyEnv(obj) {
+  for (const [k, v] of Object.entries(obj)) {
+    if (v && (!(k in process.env) || !process.env[k])) process.env[k] = v;
+  }
+}
+
+function redact(s) {
+  if (!s) return '(empty)';
+  if (s.length <= 10) return '***';
+  return `${s.slice(0, 4)}…${s.slice(-4)} (len=${s.length})`;
+}
+
+applyEnv(loadEnvFile('.env'));
+applyEnv(loadEnvFile('secrets/marqeta/credentials.env'));
+applyEnv(loadEnvFile('config/rails-marqeta-malta.env'));
+
+async function smoke() {
+  const app = process.env.MARQETA_APPLICATION_TOKEN || process.env.MARQETA_APP_TOKEN;
+  const admin = process.env.MARQETA_ADMIN_ACCESS_TOKEN || process.env.MARQETA_ADMIN_TOKEN;
+  const base = (
+    process.env.MARQETA_API_BASE_URL ||
+    process.env.MARQETA_MALTA_API_BASE_URL ||
+    'https://api.marqeta.com/v3'
+  ).replace(/\/$/, '');
+  if (!app || !admin) {
+    return {
+      ok: false,
+      configured: false,
+      error: 'MARQETA_APPLICATION_TOKEN / MARQETA_ADMIN_ACCESS_TOKEN missing',
+    };
+  }
+  const basic = Buffer.from(`${app}:${admin}`).toString('base64');
+  const res = await fetch(`${base}/cardproducts?count=5`, {
+    headers: { Authorization: `Basic ${basic}`, Accept: 'application/json' },
+  });
+  const text = await res.text();
+  let body;
+  try {
+    body = JSON.parse(text);
+  } catch {
+    body = { raw: text.slice(0, 160) };
+  }
+  const products = Array.isArray(body?.data) ? body.data : [];
+  return {
+    ok: res.status >= 200 && res.status < 300,
+    configured: true,
+    http: res.status,
+    baseUrl: base,
+    applicationToken: redact(app),
+    adminToken: redact(admin),
+    cardProductSet: Boolean(process.env.MARQETA_CARD_PRODUCT_TOKEN),
+    cardProductCount: products.length,
+    liveGate: process.env.SETTLEMENT_ALLOW_MARQETA_PRODUCTION === '1',
+    region: process.env.MARQETA_REGION || 'MT',
+    error: res.ok ? undefined : body?.error_message || text.slice(0, 180),
+  };
+}
+
+const result = await smoke();
+console.log(JSON.stringify({ asOf: new Date().toISOString(), marqetaMalta: result }, null, 2));
+process.exit(result.ok ? 0 : result.configured ? 2 : 3);