feat(clearing): add CTS/NACH clearing modules with real NPCI integration

- Inward/outward CTS clearing (capture, validate, settle, dishonour), positive pay,
  settlement/reconciliation, and NACH clearing modules
- Real, separate NPCI clearing-house integration: hybrid RSA+AES envelope crypto,
  bank self-registration, outward batch submission, and an inward push webhook
- Outward clearing is now session-batched: a 2-hourly scheduled job (plus the
  existing manual "Send Pending Batch" fallback) bundles CAPTURED cheques instead
  of sending them one at a time
- Batch-summary read APIs and date/text filters across inward batches, outward
  presentments, and outward batches

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

fineract-provider/src/main/resources/application.properties

@@ -690,3 +690,22 @@ fineract.email.support-address=${FINERACT_EMAIL_SUPPORT_ADDRESS:support@cbsnexor
 
 # Frontend base URL — used for email links (voting, etc.)
 cbs.frontend.base-url=${CBS_FRONTEND_BASE_URL:https://cbs.godemo.in}
+
+# ── NPCI Clearing House Integration ──────────────────────────────────────────
+# Real, separate NPCI service (see /npci-clearing-house) — this CBS registers itself as a bank there
+# (its own key pair, generated locally, only the public half is ever sent) and submits outward CTS
+# batches to it. NPCI's own public key is fetched live via GET {base-url}/npci/public-key, never configured
+# here — no key material is ever copy-pasted between the two services.
+fineract.npci.base-url=${FINERACT_NPCI_BASE_URL:http://localhost:8444}
+fineract.npci.bank-code=${FINERACT_NPCI_BANK_CODE:CBSHOME01}
+fineract.npci.bank-name=${FINERACT_NPCI_BANK_NAME:CBSnexora Home Bank}
+fineract.npci.ifsc-prefix=${FINERACT_NPCI_IFSC_PREFIX:CBSH}
+# Where NPCI can push routed packages destined for this bank: POST /api/v1/npci/inward-push. NOTE this
+# Fineract fork identifies the tenant via the Fineract-Platform-TenantId HEADER, not a URL path segment —
+# there is no "/default/" (or any tenant) segment in the path itself; NPCI's push client must send that
+# header (defaults to "default", the only tenant this dev setup has).
+# ALSO NOTE: CBS's own HTTPS certificate is self-signed in this dev setup — NPCI's JDK HttpClient will fail
+# TLS validation against it unless NPCI is separately configured to trust it. Until then, pushes here
+# will fail and NPCI gracefully falls back to the poll model (GET /clearing/inward/{bankCode}).
+fineract.npci.inward-callback-url=${FINERACT_NPCI_INWARD_CALLBACK_URL:https://localhost:8443/fineract-provider/api/v1/npci/inward-push}
+fineract.npci.timeout-ms=${FINERACT_NPCI_TIMEOUT_MS:10000}