Add optional KYC flow and service-backed account limits

docs/implementation.md

@@ -141,3 +141,29 @@ current packages, app/website commands, verification previews, analytics limits,
 skill location and contribution workflow. Local links and diff checks pass;
 commands and prerequisites were checked against repository configuration.
 Documentation only; no runtime tests were run.
+
+## Optional identity verification and backend-owned limits — task #20
+
+- Branch: `kyc-20`, based on `61ccfc1` (main after README PR #19).
+- Planned the UX before implementation in [docs/ux/kyc.md](ux/kyc.md), including
+  optional basic access, two-photo preparation/review, pending and decision states,
+  errors, recovery, privacy and measurement definitions.
+- Added the mobile-reusable `sxchnge_kyc` package, injectable identity/photo/limits
+  services, transport mappers and providers. Followed Sendico's visible-limits
+  ownership boundary; current tier/caps/remaining amounts come from a service.
+- Added themed EN/RU `/identity` screens, login/email-confirmation entry points,
+  route exit guards, review/replace/discard controls, safe error messages and
+  demo-only backoffice decision controls. No real documents are transmitted.
+- Reviewed full frontend scope and corrected web image-metadata validation,
+  stale-state messaging, cancelled-picker analytics, step focus/scroll behavior,
+  duplicate submissions and sensitive image cache cleanup.
+- Validation: format check for all 27 changed/new Dart files; analyzer passes for
+  app, sxchnge_kyc and sxchnge_analytics; `make test-frontend` passes **86 tests**
+  (10 KYC, 7 analytics, 20 auth, 3 theme, 3 consumer example, 43 app). Web build
+  passes. Actual browser selection of generated PNG samples reached pending
+  review with unchanged basic limits. EN/RU, 320px/1.6 text scale, accessibility
+  labels/tap targets, route guards and all decision paths have widget coverage.
+- Limits are illustrative backend-stub fixtures. Real authenticated uploads,
+  private storage, staff review, support, authoritative limits enforcement and
+  server-side review analytics remain integration work. Native mobile and
+  VoiceOver/TalkBack checks remain release QA. Security scans were not requested.