feat: harden AML velocity rule for sliding-window smurfing detection

[Tobore2000]

Summary\n- Add PostgreSQL-backed persistence for aml_investment_velocity using a composite-key upsert.\n- Wire the production AML factory to the database velocity repository.\n- Make repeated alerts for the same investment and rule version idempotent.\n- Add repository and service regression tests plus security and operations documentation.\n\n## Security and correctness\n- Failed investments are excluded and investor/window boundaries are enforced.\n- Late-arriving events update the existing aggregate row without duplication.\n- Alert details retain linked investment IDs for analyst traceability.\n- Monetary aggregate persistence uses PostgreSQL NUMERIC; evaluator precision assumptions are documented.\n\n## Validation\n- Focused AML tests: npx jest --runInBand src/aml/ruleEvaluator.test.ts src/aml/amlService.test.ts src/aml/velocityRepository.test.ts\n- Result: 3 suites passed, 80 tests passed.\n- Full npm test: blocked by broad ts-jest transform failures (221 failed, 11 passed) with TypeError: Cannot read properties of undefined (reading toString).\n- npm run build: blocked by unrelated pre-existing TypeScript errors in distribution/reconciliation services.\n- ESLint: unavailable because the repository has no ESLint 9 flat config.\n