Add TPIN creation, TPIN-authorised transfers, MPIN reset and transfer history

- Create TPIN: current MPIN -> OTP -> encrypted TPIN via /tpin/create/*,
  from Services and from the transfer screen on TPIN_NOT_SET
- IMPS initiate now sends encryptedTpin instead of encryptedMpin; handles
  INVALID_TPIN and TPIN_NOT_SET
- Share one RSA-OAEP encryption and key-retry path for MPIN and TPIN
- Forgot MPIN on sign-in and Reset MPIN in the Security Center
- Fund transfer history list and detail, reachable from Home
- Brand logo on sign-in and palette updates

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/modules/payments/utils/tpinValidation.test.ts

@@ -0,0 +1,67 @@
+import {
+  TPIN_LENGTH,
+  describeTpinProblem,
+  isAcceptableNewTpin,
+  isValidTpinEntry,
+} from './tpinValidation';
+
+describe('isValidTpinEntry', () => {
+  it('accepts exactly four digits', () => {
+    expect(TPIN_LENGTH).toBe(4);
+    expect(isValidTpinEntry('2580')).toBe(true);
+    expect(isValidTpinEntry('258')).toBe(false);
+    expect(isValidTpinEntry('25801')).toBe(false);
+    expect(isValidTpinEntry('25a0')).toBe(false);
+  });
+
+  // On a transfer the server decides whether the digits are right, so an
+  // entry the create rules would refuse must still be typeable.
+  it('does not apply the choosing rules to an entry', () => {
+    expect(isValidTpinEntry('1234')).toBe(true);
+    expect(isValidTpinEntry('1111')).toBe(true);
+  });
+});
+
+describe('describeTpinProblem', () => {
+  it('says nothing about an empty field', () => {
+    expect(describeTpinProblem('')).toBeUndefined();
+  });
+
+  it('asks for four digits until there are four', () => {
+    expect(describeTpinProblem('25')).toBe('A TPIN is 4 digits');
+    expect(describeTpinProblem('2a')).toBe('Digits only');
+  });
+
+  it('refuses ascending and descending runs', () => {
+    expect(describeTpinProblem('1234')).toMatch(/run of digits/);
+    expect(describeTpinProblem('4321')).toMatch(/run of digits/);
+    expect(describeTpinProblem('6789')).toMatch(/run of digits/);
+  });
+
+  it('refuses the same digit repeated', () => {
+    expect(describeTpinProblem('1111')).toMatch(/same digit/);
+  });
+
+  it('refuses the last four digits of the registered mobile', () => {
+    expect(describeTpinProblem('0101', '9300000101')).toMatch(/last four digits/);
+    expect(describeTpinProblem('0101', '+91 93000 00101')).toMatch(/last four digits/);
+    expect(describeTpinProblem('0102', '9300000101')).toBeUndefined();
+  });
+
+  it('skips the mobile rule when the number is unknown', () => {
+    expect(describeTpinProblem('0101')).toBeUndefined();
+    expect(describeTpinProblem('0101', '')).toBeUndefined();
+  });
+});
+
+describe('isAcceptableNewTpin', () => {
+  it('accepts a TPIN that breaks no rule', () => {
+    expect(isAcceptableNewTpin('2580', '9300000101')).toBe(true);
+  });
+
+  it('refuses one that breaks any rule, or is incomplete', () => {
+    expect(isAcceptableNewTpin('258')).toBe(false);
+    expect(isAcceptableNewTpin('1234')).toBe(false);
+    expect(isAcceptableNewTpin('0101', '9300000101')).toBe(false);
+  });
+});