fix: IPSAS double-entry compliance matrix for M0-M4 journals

Replace invalid same-GL pairs (2000/2000) with proper Dr/Cr legs, add M2-M4 and inter-office entries (1410/2410), extend IPSAS registry accounts, and reject same-account pairs at validation load time.

Co-authored-by: Cursor <cursoragent@cursor.com>

services/token-aggregation/src/api/routes/omnl-ipsas.ts

@@ -31,7 +31,7 @@ router.get('/omnl/ipsas/registry', omnlSensitiveRouteGuard, (_req: Request, res:
 });
 
 /**
- * GET /omnl/ipsas/matrix — journal matrix (T-001…T-008) for Fineract posting alignment.
+ * GET /omnl/ipsas/matrix — IPSAS double-entry journal matrix (T-001…T-H24, M0–M4 rails).
  */
 router.get('/omnl/ipsas/matrix', omnlSensitiveRouteGuard, (_req: Request, res: Response) => {
   try {
@@ -213,7 +213,7 @@ router.get('/omnl/ipsas/compliance-context/:lineId', omnlSensitiveRouteGuard, as
       ipsas: {
         monetaryLayerHints: registry.monetaryLayerHints,
         postingGuidance:
-          'Reserve movements (M0) map to GL 1050; M1 liabilities to 2000/2100; settlement to 1000. Validate every journal with GET /api/v1/omnl/ipsas/validate-pair before POST /journalentries.',
+          'IPSAS double-entry: every journal must debit one GL and credit a distinct GL (debitGlCode !== creditGlCode). M0→1050, M1→2000/2100, M2→2200, M3→2300, M4 suspense→1000, inter-office→1410/2410. Validate pairs via GET /api/v1/omnl/ipsas/validate-pair or POST /api/v1/omnl/ipsas/validate-pairs before POST /journalentries.',
         fineractDocs: 'https://omnl.hybxfinance.io/fineract-provider/swagger-ui/index.html',
       },
     });