fix: Phase C IPSAS matrix (2100/2410 HO legs) and runtime double-entry guards

Align interoffice HO allocations to 2100→2410 with branch 1410→2100 two-leg entries, registry v1.2.1, explicit same-GL rejection in validators, doc matrices, and validation tests.

Co-authored-by: Cursor <cursoragent@cursor.com>

services/token-aggregation/src/api/routes/omnl-ipsas.ts

@@ -4,6 +4,7 @@ import { omnlSensitiveRouteGuard, omnlRequireApiKeyInProduction } from '../middl
 import { omnlAuditMiddleware } from '../middleware/omnl-audit-middleware';
 import {
   loadIpsasRegistry,
+  isDoubleEntryPair,
   validateJournalPairWithMatrix,
   fetchFineractGlAccounts,
   compareRegistryToFineract,
@@ -78,7 +79,9 @@ router.post('/omnl/ipsas/validate-pairs', (req: Request, res: Response) => {
       return {
         debitGlCode,
         creditGlCode,
+        doubleEntryValid: debitGlCode !== creditGlCode,
         ipsasCompliantPair: v.valid,
+        rejectReason: v.rejectReason,
         ipsasRef: v.ipsasRef,
         memo: v.memo,
         narrative: v.narrative,
@@ -107,13 +110,16 @@ router.get('/omnl/ipsas/validate-pair', (req: Request, res: Response) => {
     } catch {
       matrix = null;
     }
+    const doubleEntryValid = isDoubleEntryPair(debitGlCode, creditGlCode);
     const v = validateJournalPairWithMatrix(registry, matrix, debitGlCode, creditGlCode);
     const debitKnown = registry.accounts.some((a) => a.glCode === debitGlCode);
     const creditKnown = registry.accounts.some((a) => a.glCode === creditGlCode);
     res.json({
       debitGlCode,
       creditGlCode,
+      doubleEntryValid,
       ipsasCompliantPair: v.valid,
+      rejectReason: v.rejectReason,
       ipsasRef: v.ipsasRef,
       memo: v.memo,
       narrative: v.narrative,