Submit customer identity proofs and show reviewed limits

docs/implementation.md

@@ -883,3 +883,32 @@ parallelism resolved that infrastructure contention. The next full run exposed
 the new locale fixture disposal error noted above; the corrected final run
 passed, including EN/RU support states and verification recovery. No checks were
 weakened or unrelated work changed.
+
+## Customer identity verification — task #48
+
+[Implementation and rollout](identity-verification.md) adds optional verification
+on authenticated onboarding and later from the account: legal profile, ID photo
+and selfie holding the same ID. Real adapters replace demo KYC/limits in backend
+mode. Sendico's existing backoffice owns decisions and the reviewed Limits profile;
+SXCHNGE has no local tenancy, roles or policy engine. Provider-subject uniqueness,
+private bounded uploads, stable retries, exact decimal policy projections and
+explicit upgrade-pending feedback are included. The unrelated notifications
+runtime configuration is excluded.
+
+The implementation requires Sendico #2885 and follows sign-up Facts PR #47.
+Validation and delivery links are recorded below after the final checks.
+
+Completion review covered the full backend and frontend contribution, including
+subject ownership, private uploads, idempotent retries, session changes, exact
+limits, DTO/mapper/service/model/provider boundaries, and the UX/measurement
+checklists. Review fixes included duplicate-binding error classification,
+upgrade-pending feedback, bounded response timeouts and stale-session protection.
+
+Final validation passed: `GOFLAGS=-p=1 make test` (all backend race tests and all
+frontend suites; 79 app tests), `make lint-backend`, changed-Dart formatting,
+and `flutter analyze` in the app and shared KYC package. Focused KYC adapter and
+onboarding tests passed (20 tests), as did focused Go identity/provider/HTTP
+checks. An initial parallel run hit the existing Testcontainers reaper deadline;
+serial Go package execution resolved local Docker contention without weakening
+checks. No optional security scan, live customer proof, email, production
+approval, deployment or merge was performed. Generated outputs remain ignored.