[Notif] Email/SMS Alerts for Loan Status

[EbukaMoses]

close #151

This PR adds Email and SMS/WhatsApp alerts for key loan lifecycle events. Here's how it works end-to-end:

Triggers — notifications fire on:

Loan approved / rejected / under review
Payment due (configurable days before, default 3 days)
Payment overdue (checked every 6 hours by default)
Loan disbursement
Repayment confirmation
Account security alerts (login, password/email/phone change)
Providers:

Email — SendGrid (@sendgrid/mail)
SMS / WhatsApp — Twilio (twilio)
Flow:

A loan event occurs (on-chain indexer or API action)
ExternalNotificationService checks the user's stored preferences (notification_preferences table)
If the user has email/SMS enabled for that event type, it dispatches via SendGrid / Twilio
All sends are logged to notification_logs for audit
A node-cron scheduler runs independently to check upcoming/overdue payments and fire reminders automatically
Required env vars to add to .env:

SENDGRID_API_KEY=
FROM_EMAIL=noreply@remitlend.com
FROM_NAME=RemitLend

TWILIO_ACCOUNT_SID=
TWILIO_AUTH_TOKEN=
TWILIO_PHONE_NUMBER=
TWILIO_WHATSAPP_FROM= # optional, only if using WhatsApp

NOTIFICATION_CHECK_INTERVAL_MINUTES=60
PAYMENT_OVERDUE_CHECK_INTERVAL_HOURS=6
PAYMENT_REMINDER_DAYS_BEFORE=3

[ogazboiz]

hey @EbukaMoses — Email/SMS alerts for loan status is a genuinely useful feature. that's a significant amount of work across the notification services, email, SMS, webhooks, and routes.

before we can review this properly, a few things:

1. PR description — could you add a summary of what the notification flow looks like? e.g. what triggers an email/SMS, what providers are being used (Twilio? Sendgrid?), and what env vars are needed
2. CI — can you confirm tests pass locally? GitHub isn't showing CI results
3. Scope check — the PR touches 35+ files including migrations, new services, frontend changes. are all of these directly related to the notification feature, or did some unrelated changes get bundled in?

happy to do a full review once we have that context. looking forward to seeing this land!

join us on Telegram: https://t.me/+DOylgFv1jyJlNzM0

[ogazboiz]

The codebase issues on main have been resolved and all CI checks are passing now. Please rebase your branch to pull in the latest changes before continuing. Thanks for your patience.

[ogazboiz]

7,454 additions is too large for one PR. Migration numbers (1773, 1774) are below the current highest (1783) and will run out of order. Remove the AI-generated NOTIFICATION_SYSTEM_COMPLETE.md file. Split this into smaller PRs (migration, services, routes, scheduler). Needs rebase.

[ogazboiz]

heads up, a few important changes just landed on main that affect your PR:

1. axios pinned to 1.13.5 - there's an active supply chain attack on axios 1.14.1 (pulls in confirmed malware). we added overrides in all package.json files to block it.

2. CI now runs a supply chain audit before backend/frontend jobs. if your lockfile has a compromised package, CI will fail with a clear error.

3. backend test fixes - loanEndpoints tests now use valid Stellar addresses and base64 strings. if your PR was failing backend CI but you didn't touch backend code, this should fix it after rebase.

please rebase on latest main:

git fetch upstream
git rebase upstream/main
git push --force-with-lease

[ogazboiz]

hey @EbukaMoses, CI is green now which is progress. but the three issues from before still aren't addressed:

1. Migration numbers - 1773 and 1774 will run out of order. current highest on main is 1785000000015. rename them to 1786000000016 and 1787000000017.

2. NOTIFICATION_SYSTEM_COMPLETE.md - AI-generated doc, please remove it.

3. PR scope - 35 files is still very large. consider splitting into at minimum: (a) migration + schema, (b) services, (c) routes/controllers.

fix the migration numbers and remove the doc file at minimum before we can merge.

[ogazboiz]

hey @EbukaMoses, the diff has gotten significantly worse since the last review. a few critical issues:

1. migrations - the PR now includes ALL existing migrations from main (1777 through 1785) in the diff. these should not be here at all. this means the branch is not properly rebased — it's showing files that already exist on main as if they're new additions. please do a clean rebase:

git fetch upstream
git rebase upstream/main
git push --force-with-lease

2. NOTIFICATION_SYSTEM_COMPLETE.md - still present, still needs to be removed.

3. scope - the diff is now 70+ files which is too large to review safely. the new notification files (emailService, smsService, externalNotificationService, schedulerService, routes) are the actual feature. everything else in the diff should not be there.

please rebase cleanly first. that should collapse the diff down to just the notification-specific files. then we can do a proper review.