Surface Quickpay's fraud signals

[loevgaard]

Closes #132.

Three surfaces for the fraud data the SDK already models (Metadata::$fraudSuspected, PaymentsQuery's fraudSuspected filter):

Admin badge

The operation history panel shows a red Fraud suspected label next to the existing test-mode badge, read off the fetched payment's metadata. Translated in all 16 locales.

Opt-in capture guard

setono_sylius_quickpay:
    fraud:
        block_capture: true   # default false

When enabled, PaymentProcessor consults the new Fraud\FraudChecker before the automatic capture on the complete transition and skips the capture with a warning when Quickpay reports the payment as fraud suspected — the transition itself proceeds (mirroring how a failed cancel is handled), leaving the payment for manual review in the Quickpay manager.

Design choices:

• Fails open on every unanswerable case — no Quickpay payment id, no api key, Quickpay unreachable — so a broken check never blocks the payment flow.
• Off by default because the check costs one extra Quickpay API call per automatic capture; the config info says so.
• The checker is its own FraudCheckerInterface seam (with interface alias, per the repo convention), so the processor's tests stay cheap.

Reconcile report mode

bin/console setono:sylius-quickpay:reconcile-payments --fraud-suspected --since="7 days"

Unlike reconciliation (which walks local pending payments), this asks Quickpay directly: every configured Quickpay gateway's account is queried for payments flagged in the period, regardless of local state, and printed as a table (gateway, Quickpay id, order id, state, created, test mode). Report only — nothing is transitioned or persisted. Exit code fails only on API errors.

Tests

The SDK's endpoint classes are final and cannot be doubled, so the new tests run the real SDK client against a canned-response PSR-18 stub (tests/Quickpay/FixedResponseHttpClient) — covering the flagged/clean/no-id/no-key/unreachable paths of the checker and the report mode end to end through the command. Processor tests pin: capture skipped on suspicion, capture proceeds when clean, and the checker is never consulted when the guard is off.

The report mode was also verified live against the real Quickpay API (empty result on an account with no flagged payments).

README (Fraud signals section), UPGRADE-2.0.md, and CLAUDE.md updated.

[codecov]

Codecov Report

❌ Patch coverage is 97.56098% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 94.27%. Comparing base (b47fe4b) to head (567dd08).
⚠️ Report is 1 commits behind head on 2.x.

Files with missing lines	Patch %	Lines
src/Controller/Admin/PaymentOperationsAction.php	75.00%	1 Missing ⚠️
src/Quickpay/ApiKeyResolver.php	88.88%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##                2.x     #139      +/-   ##
============================================
+ Coverage     93.86%   94.27%   +0.41%     
- Complexity      205      226      +21     
============================================
  Files            25       27       +2     
  Lines           766      839      +73     
============================================
+ Hits            719      791      +72     
- Misses           47       48       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.