api-gateway merchant suspension check is checked too late

[0xBernny]

Description

This pull request addresses a structural lifecycle vulnerability where merchant suspension validation logic executed too late in the request processing pipeline (occurring after body data parsing and rate-limit evaluation). This allowed suspended identities to consume gateway computation resources and leaked underlying account existence flags.

Key Changes

1. Early Lifecycle Hook: Engineered an upfront preHandler execution hook (checkMerchantSuspension) processing requests before body schemas enter heavy stream parsing.
2. Unified Response Model: Standardized a consistent 403 Forbidden (MERCHANT_SUSPENDED) error payload surface across all integrated routing domains.
3. Validation Isolation: Adjusted merchant-suspension.test.ts to assertively guarantee execution terminates cleanly at the threshold layer before deep functional processing begins.

Lifecycle Interception Verification

When an inbound request targeting a restricted endpoint is intercepted, the route lifecycle timeline verifies premature termination:

# Executing request with an explicit suspended signature header
curl -i -H "x-merchant-id: merch_suspended_99" https://api-gateway.local

HTTP/1.1 403 Forbidden
Content-Type: application/json

{"error":"Forbidden","message":"Merchant account is suspended.","code":"MERCHANT_SUSPENDED"}
# Request terminated cleanly in 2ms without hitting rate-limiters or body stream buffers

Related Issues

• Closes api-gateway merchant suspension check is checked too late #470

Checklist

• I have read the CONTRIBUTING.md guidelines.
• I have updated the documentation accordingly.
• I have added/updated tests for my changes.
• All CI validations pass.

[drips-wave]

@0xBernny Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits