Hidden-counterparty backfill — verification report

Adds POST /cash/v1/admin/backfill/hidden-counterparty-tombstones (admin role, 202) scoped by userIds or an occurredAt window. A coordinator + batch BullMQ worker pair pages cash_activity via Kysely keyset pagination, rechecks each row's counterparty.address against the current dynamic + baseline hidden set, and publishes a deleted: true envelope per match so the Activity Service drops them.

Why: William Lee's filter (#24373, #24370, #24377) hides those activities at read time. The Cash service's own API already hides them, but the downstream Activity Service (fed by the publishActivityFeedUpdate Kafka producer) has no such filter — older activities published before an admin added a new hidden address still surface there. This backfill brings the downstream feed in sync.

POST /cash/v1/admin/backfill/hidden-counterparty-tombstones
        │ { userIds? : UUID[],  startDate? : ISO,  endDate? : ISO }
        │  (at least one of userIds, startDate required)
        ▼
AdminService.enqueueHiddenCounterpartyTombstoneBackfill
   ├─ validates scope (BadRequestException on empty / bad dates)
   └─ QueueService.enqueueHiddenCounterpartyTombstoneBackfill
        │ jobId = sha256( {sortedUserIds, startDate, endDate} ).slice(0,16)
        ▼
   ┌──────────────────────────────────────────────────────────────┐
   │  HiddenCounterpartyBackfillCoordinatorWorker  (concurrency 1) │
   │                                                              │
   │  1. snapshot hidden set = baseline ∪ dynamic-list            │
   │  2. short-circuit if empty                                   │
   │  3. while page = cashActivityScanRepo.scanPage(...)          │
   │       emit batch job { activityIds, hiddenAddresses }        │
   │       updateData({ afterId, scanned, nextBatchIndex })       │
   │  4. each batch jobId = `${coordId}:batch:${index}`           │
   └─────────────────────────┬────────────────────────────────────┘
                             ▼
   ┌──────────────────────────────────────────────────────────────┐
   │  HiddenCounterpartyBackfillBatchWorker  (concurrency 5–20)   │
   │                                                              │
   │  for each id → fetch activity                                │
   │  if counterparty.address ∈ hiddenSet                         │
   │      AND occurredAt ≥ hiddenCounterpartyFilterStartDate      │
   │      AND mapCashActivityType(type) !== null:                 │
   │    publish( buildCashActivityEnvelope(act, [], {deleted:true}) )
   └─────────────────────────┬────────────────────────────────────┘
                             ▼
                    Kafka  → Activity Service consumer (dedups by envelope id)