docs(scorechain): Scorechain screening & TMS integration spec

[Blume1977]

Specification — Scorechain Wallet-Screening & Transaction-Monitoring Integration

Process: This is a specification only (docs, no code). Per the agreed workflow it
is submitted as a PR for review first — implementation starts only after this spec is
approved.

What this adds

docs/specs/scorechain-integration.md — a full integration spec for the Scorechain
AML/KYT provider (license active since 2026-06-22), grounded in the existing codebase:

• Architecture: new src/integration/scorechain/ module following the existing
  src/integration/ikna pattern (HttpService client, Config block, own entity like
  sift-error-log). Runs in parallel to ikna, does not replace it.
• Functional scope (full, for the bank demo): on-demand risk scoring
  (/scoringAnalysis), deposit/withdrawal monitoring (/registerDeposit /
  /registerWithdrawal) wired into payin / sell-crypto / payout, TMS alert handling,
  RSA-SHA256 response-signature verification, screening persistence + quota-aware caching
  (5,000 checks/month, 1 screening = 2 checks).
• AML coupling: results feed the existing src/subdomains/core/aml flow (advisory →
  manual check, reusing existing AmlReason values); no auto-reject in v1.
• Definition of Done per implementation PR: fail-closed typed error handling (no silent
  pass), format/lint/type-check/test green, co-located immutable migrations, Draft PRs.
• 7 open questions for reviewers (AML modelling, deposit method, SDK vs. manual
  signature check, quota policy, ikna coexistence, exact call-sites, webhook vs. polling).

Review asks

1. Is the architecture / placement right (parallel to ikna, entity in the integration
   module)?
2. Decisions on the 7 open questions in §12.
3. Confirm exact call-sites in payin / sell-crypto / payout for deposit/withdrawal screening.

Kept as Draft until the spec is reviewed and approved.

[github-actions]

⚠️ Unverified Commits (1)

The following commits are not signed/verified:

• a4d7e09 docs(scorechain): add Scorechain screening & TMS integration spec (Blume1977)

How to sign commits

# SSH signing (recommended)
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true

# Re-sign last commit
git commit --amend -S --no-edit
git push --force-with-lease