QA and Security Testing for Fix/Phase0-Security

You are a QA and security tester. Branch under test: fix/phase0-security.
Do NOT modify any source files. You may create temporary test scripts in
/tmp or a tests/qa folder. Run everything against a LOCAL server with a
throwaway database. Never contact production or real Cashfree/SMS APIs
(mock them). Never print real secret values.

Setup: start the server locally in production mode (NODE_ENV=production)
with test env values. Seed test users: OWNER, ADMIN(SUPPORT), ADMIN(MASTER),
PARTNER, AGENT, and two USER accounts.

For each check below, report PASS / FAIL / UNVERIFIED with the exact
request, response status/body, and file:line of the relevant code.

A. REVIEWER LOGIN
1. REVIEW_LOGIN_* unset: phone 7750038967 + OTP 123456 -> must FAIL.
2. Enabled with fake phone + correct OTP -> succeeds, token role is USER.
3. Same OTP on the OWNER, ADMIN, PARTNER and AGENT phones -> must FAIL.
4. Expiry in the past -> must FAIL.
5. Wrong OTP of different length -> FAIL with no crash (no exception).
6. Review login hits the rate limiter after repeated attempts.
7. A log line 'review_login_used' is written on success.

B. WALLET / CANCELLATION
1. Unpaid COD order, then cancel -> wallet unchanged.
2. Unpaid online (pending payment) order, then cancel -> wallet unchanged.
3. Paid online order, cancel -> exactly one wallet credit.
4. Cancel the same order twice, and also 10 parallel cancel requests ->
still exactly one credit (race condition test).
5. Search all other code paths that credit wallets (subscription cancel,
returns, disputes, referral, withdrawals reject). List each and say
whether it checks that real payment occurred.
6. After all tests, wallet_transactions sums must reconcile with balances.

C. ADMIN / OWNER PROTECTION
1. ADMIN(SUPPORT): DELETE the OWNER -> 403.
2. OWNER cannot delete self; ADMIN cannot delete self.
3. ADMIN(SUPPORT/MASTER): change anyone's admin_role -> 403; OWNER -> OK.
4. ADMIN cannot PATCH the OWNER's data (phone, role, password).
5. A PARTNER or USER cannot call any /api/admin/* route.

D. ROUTES
1. /api/admin/... routes respond (200/401/403, not 404).
2. /api/api/... returns 404.
3. grep the frontend for '/api/api' -> zero matches.

E. SECRETS
1. Boot in production with JWT_SECRET unset -> exits non-zero with a clear
error. Repeat for each required env var.
2. grep repo (excluding node_modules) for 'aqua_secret_key_fallback',
'Panigadi@', 'C-BC2B0D8CF48846F', '7750038967'. Report file:line only.
3. List any other hardcoded secret-looking strings.
4. Check git history for those strings (git log -S) and report commit
hashes only.
5. Confirm the Cashfree webhook still verifies the signature after the
config refactor: valid signature -> 200; invalid or stale timestamp
-> rejected; replayed event -> processed once.

F. REGRESSIONS
1. Run the full existing test suite; report counts and failures.
2. Smoke test: OTP login as USER, browse products, create an order, pay
(mock gateway), partner sees the order, agent delivers, payout
becomes eligible.
3. Run npm audit in server/ and root; list high/critical findings.

G. SUMMARY
Table of every check with PASS/FAIL. Then a ranked list of anything that
FAILED or looks risky, and any behaviour you could not verify. Be blunt.