fix: prepare for Bridge KYC Level 2 upgrades; proxy-addr 2.0.8

[islandbitcoin]

Summary

Prepares flash for frappe-flash-admin's Bridge KYC → Level 2 auto-upgrade (lnflash/frappe-flash-admin#80). That job files Level 2 Account Upgrade Requests with no address and leaves the account with no bank account. It also fixes the Audit check that was failing on every PR.

1. Resolve an upgrade request that has no address. Address has non-null title/line1/city/state/country. The app's LatestAccountUpgradeRequest errored with Cannot return null for non-nullable field Address.city. Those fields now resolve to "". The nullable fields are untouched and a submitted address comes back unchanged. No schema change.

2. Require a complete address on customer-submitted requests. #80 drops reqd from the ERP request's address fields, because frappe enforces it on every save. ERPNext had been the only thing rejecting "" on a customer's request. The model now refuses a blank title, line1, city, state or country.

3. Level 2 no longer implies a bank account on file. deriveCapabilitiesForAccount ORed level >= 2 into bankPayout, so every L2 reported bank payout. That made the app hub show "Bank cash-out ✓ On" with no bank, and let a Business (L3) capability request skip its bank check.

• Only L3 now implies bankPayout from the stored level. When ERPNext answers, its bank accounts decide.
• The stored level still stands in when ERPNext can't answer (no erpParty, or a failed lookup), so legacy behaviour is unchanged.
• A BANK_PAYOUT capability request from an L2 account now gets "add a bank account instead". The app routes those accounts to Bank accounts (fix(upgrade): handle Level 2 accounts upgraded on Bridge KYC flash-mobile#757).

4. proxy-addr 2.0.8, which fixes the Audit job. yarn audit --level critical was failing on every flash PR since 2026-10-05: GHSA-jqcg-44mw-7w3h / CVE-2026-90711, "IP spoofing via IPv4-mapped IPv6 trust subnet". All three paths go through express's proxy-addr@~2.0.7, so the lockfile entry moves to 2.0.8 within that range, with no package.json change.

• Same dependencies as 2.0.7.
• The tarball's sha1/sha512 match the registry, and it carries SLSA provenance.
• Its changelog lists only this fix.
• Flash trusts proxies by hop count ("trust proxy", 1), not by subnet, so no behaviour changes.
• Locally: critical findings go from 3 to 0, the gate passes, and yarn install --frozen-lockfile accepts the lockfile.

Tests

• account-upgrade-request-address.spec.ts runs the app's LatestAccountUpgradeRequest document verbatim against the real payload type. It fails without fix 1.
• AccountUpgradeRequest.spec.ts covers the incomplete-address refusal.
• Capability specs:
  • L2 without a bank account → no bankPayout, headline still VERIFIED;
  • no erpParty or a failed lookup → stored level stands in;
  • BANK_PAYOUT at L2 → clear error;
  • a Business request without a bank on file must include one.
• Mutation-checked: reverting each change turns its spec red.
• Full unit suite: 278 suites, 3,502 passed (3 skipped).
• typos, prettier 3.6.2 (the CI pin) and eslint are clean.

Deploy order

Ship this before #80 is switched on. On its own, fixes 1–2 change nothing for existing requests. Fix 3 changes only what an L2 account with an ERP party but no bank account sees; Bridge upgrades are what create those.

🤖 Generated with Claude Code