docs: payment domain assessment — gap analysis, capability map, decomposition recommendations

[devin-ai-integration]

Summary

Adds three documentation deliverables assessing the payment domain across all 6 microservices:

1. docs/PAYMENT_GAP_ANALYSIS.md — Compares current fund-transfer and utility-payment payloads against ISO 20022 standards (pain.001, pain.002, pacs.008). Documents 16 gaps rated by severity, covering missing fields, absent validation rules (no amount limits, no idempotency, no duplicate detection), and missing currency handling.

2. docs/BUSINESS_CAPABILITY_MAP.md — Maps each microservice to business capabilities, identifies 4 capability overlaps (dual transaction recording, dual user management, duplicated DTOs, duplicated infrastructure code) and 9 capability gaps (notifications, transaction history, payment scheduling, fraud detection, etc.). Assesses that current boundaries are technical-layer-based rather than business-capability-aligned.

3. docs/DECOMPOSITION_RECOMMENDATIONS.md — Recommends 5 structural changes: merge fund-transfer + utility-payment into a unified Payment Service, split core-banking into Account Service + Transaction Service, restructure user-service into an Identity Service, add a Notification Service, and extract a shared library. Includes current vs. proposed dependency diagrams and a prioritized phased roadmap.

No code changes — documentation only.

Review & Testing Checklist for Human

• Verify the ISO 20022 field mappings in PAYMENT_GAP_ANALYSIS.md are accurate for your specific regulatory jurisdiction
• Confirm the business capability assignments in BUSINESS_CAPABILITY_MAP.md match your team's understanding of service responsibilities
• Review the decomposition priorities in DECOMPOSITION_RECOMMENDATIONS.md against your team's capacity and roadmap

Notes

• The analysis is based on the current source code in the repository. The README mentions a planned Notification Service that is not yet implemented — this is reflected in the capability gap analysis.
• The gap severity ratings prioritize financial safety (idempotency, amount validation) as CRITICAL and standards compliance as HIGH/MEDIUM.

Link to Devin session: https://partner-workshops.devinenterprise.com/sessions/0351fd152c8c4766884d120583512799
Requested by: @DhrovS

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.