feat: Comprehensive QA suite — load testing, security, chaos, DR, compliance, canary CI/CD

[devin-ai-integration]

Summary

Adds a full QA automation framework (2,997 lines across 24 files) designed for CI/CD reuse. Every script is self-contained, accepts BASE_URL as parameter, exits with code 1 on failure, and produces JSON reports for artifact collection.

New directories:

qa/
├── load-testing/          # k6: 10K user load, 30-min soak, financial reconciliation
├── security/              # OWASP API Top 10, dependency audit, Slither+Mythril
├── chaos-engineering/     # service kill, network delay, memory pressure, cascading
├── disaster-recovery/     # PG backup/restore, TigerBeetle snapshot, Redis rebuild
├── regulatory-sandbox/    # CBN, FCA, FATF, PCI-DSS compliance checks
├── canary/                # Argo Rollouts config + pre-promotion verification
└── Makefile               # make -f qa/Makefile <target>

GitHub Actions workflows:

• qa-pipeline.yml — 7-stage pipeline (unit → security → contracts → load → chaos → DR → compliance) with QA gate
• nightly-soak.yml — 30-min sustained load test for memory leak detection
• deploy-gate.yml — manual pre-production gate (tests + security + compliance → canary deploy)

Key thresholds (hard fail in CI):

• p95 latency < 500ms
• Error rate < 1%
• Financial discrepancies = 0 (zero tolerance)
• Critical npm vulnerabilities = 0
• Compliance failures = 0
• Ledger imbalance = 0 (instant canary rollback)

Local usage:

make -f qa/Makefile all                    # everything
make -f qa/Makefile security               # OWASP + deps
make -f qa/Makefile load BASE_URL=https://staging.remitflow.io

Link to Devin session: https://app.devin.ai/sessions/64d054ae77da41e9a2b74d8593fa635c
Requested by: @munisp

[devin-ai-integration]

Original prompt from Patrick

https://drive.google.com/file/d/14K-94cZoOVgiYCUA-VympU-4_8IBqv2d/view?usp=sharing
extract the contents of the archive. List all the features of the platform

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring