feat: ( payment ) implement cbe payment

apps/edr-payment-api/src/config/cbe-bill.config.ts

@@ -0,0 +1,26 @@
+import { registerAs } from "@nestjs/config";
+
+/**
+ * CBE Unified Bill Payment — the INBOUND biller integration (docs/cbe/). Deliberately separate
+ * from cbe.config.ts, which belongs to the outbound CBE_BIRR wallet gateway: two disjoint
+ * credential/auth domains that rotate independently (plan D7).
+ */
+export default registerAs("cbeBill", () => ({
+  /** Kill switch — all /cbe/* endpoints answer 503 while false. */
+  enabled: process.env.CBE_BILL_ENABLED === "true",
+  /** Credentials CBE presents to /cbe/oauth/token. */
+  clientId: process.env.CBE_BILL_CLIENT_ID || "",
+  clientSecret: process.env.CBE_BILL_CLIENT_SECRET || "",
+  /** Signs/verifies the bearer tokens WE issue to CBE — never shared with ServiceAuthGuard. */
+  jwtSecret: process.env.CBE_BILL_JWT_SECRET || "",
+  tokenExpiresIn: Number(process.env.CBE_BILL_TOKEN_EXPIRES_IN || 3600),
+  scope: process.env.CBE_BILL_SCOPE || "Unified_Outgoing",
+  /** bill-query hop to the owning domain app. Short — CBE holds its own timeout over ours. */
+  domainTimeoutMs: Number(process.env.CBE_BILL_DOMAIN_TIMEOUT_MS || 3000),
+  passengerApiBaseUrl: (
+    process.env.PASSENGER_API_BASE_URL || "http://localhost:3002"
+  ).replace(/\/$/, ""),
+  freightApiBaseUrl: (
+    process.env.FREIGHT_API_BASE_URL || "http://localhost:3001"
+  ).replace(/\/$/, ""),
+}));