feat: implement DIP/MNRL lookups and enhance Sanctions screening workflows

- Implement DIP/MNRL lookup logs table, filtering, and detail review under reports.
- Integrate DIP verification gating on client creation, allowing officers to record PROCEEDED/REJECTED decisions with reasons.
- Upgrade Sanctions verification dialog to support comparing Name, DOB, and Nationality particulars.
- Add Sanctions disposition recording (FALSE_POSITIVE / CONFIRMED_MATCH) awaiting Principal Officer approval.
- Add sanctions-alert-review-dialog for reviewers to assess and escalate/clear flagged names.
- Enforce strict screening reset logic on client name changes, preventing bypass of existing blocks.
- Update routes and shell menu navigation to include DIP/MNRL Lookups and Sanctions Logs.

fineract-provider/src/main/resources/application.properties

@@ -665,7 +665,29 @@ fineract.openproject.project-id=${FINERACT_OPENPROJECT_PROJECT_ID:cbsnexora}
 fineract.openproject.api-token=${FINERACT_OPENPROJECT_API_TOKEN:57dd9f933f113c7274e3ed3d5ca82e1e45e040c857160975087694f4d39ff596}
 
 # ── DIP / MNRL Mobile Number Lookup ──────────────────────────────────────────
-fineract.mobile-lookup.base-url=${FINERACT_MOBILE_LOOKUP_BASE_URL:http://localhost:8080}
+# Checks a mobile number against the DoT Digital Intelligence Platform (suspected numbers) and the
+# Mobile Number Revocation List (disconnected numbers). The backend calls
+# GET {base-url}/api/v1/lookup/check?mobileNumber=... and expects the response shape documented in
+# MobileLookupResult.
+#
+# A number that cannot be checked is NOT treated as clean: an unreachable service is recorded as
+# SERVICE_UNAVAILABLE and the officer must either reject the number or record a written reason to
+# proceed. So a wrong base-url here does not silently wave numbers through — it stops onboarding.
+# ┌──────────────────────────────────────────────────────────────────────────┐
+# │ LOCAL TEST LOOKUP SERVICE — NOT THE REAL DoT DIP/MNRL ENDPOINT.          │
+# │                                                                          │
+# │ This default points at scripts/mock-dip-lookup-service.js on localhost   │
+# │ so onboarding can be demonstrated end to end. Its verdicts are invented; │
+# │ NO NUMBER IS ACTUALLY CHECKED AGAINST THE DoT. Every response carries    │
+# │ provider=MOCK_DIP_LOOKUP_TEST_ONLY, which is stored in the lookup log's  │
+# │ raw response so a mock check can never be mistaken for a real one.       │
+# │                                                                          │
+# │   node scripts/mock-dip-lookup-service.js                                │
+# │                                                                          │
+# │ BEFORE PRODUCTION: set FINERACT_MOBILE_LOOKUP_BASE_URL to the real       │
+# │ DIP/MNRL provider. Do not ship the mock.                                 │
+# └──────────────────────────────────────────────────────────────────────────┘
+fineract.mobile-lookup.base-url=${FINERACT_MOBILE_LOOKUP_BASE_URL:http://127.0.0.1:8090}
 
 # ── Login OTP (2FA) — uses LincPay credentials above ─────────────────────────
 fineract.security.otp.lincpay.generate-path=${FINERACT_OTP_LINCPAY_GENERATE_PATH:/mobile/generate-otp}