fix: ajv mapping parity to joi

[gibaros]

What

Adds four Ajv keyword cases to createFSPIOPErrorFromOpenapiError so they map to FSPIOP 3101 "Malformed syntax", matching what createFSPIOPErrorFromJoiError has done for years:

Ajv keyword	joi equivalent (already → 3101)
enum, const	any.only / any.allowOnly (added for mojaloop/project#2013)
format	date.format, string.email/uri/guid
pattern	string.regex

Also includes a dev-dependency refresh (ncu 23, sinon 22.1.0, brace-expansion 5.0.8, js-yaml 4.3.0).

Why

When services migrated from hapi-openapi/joi to openapi-backend/Ajv, syntactically-invalid values (bad enum values, malformed date-times, regex violations) silently changed from 3101 "Malformed syntax" to the default 3100 "Generic validation error" — the Ajv switch never received the curation the joi switch accumulated (see #2013, which added any.only for exactly this reason). This surfaced as a breaking change in the central-ledger/central-settlement OpenAPI 3.0.3 migration (mojaloop/project#4479): Golden Path test "Check Settlements Error #956" asserts 3101 for an invalid enum query value. With this fix, that migration ships with no API-visible behavior change.

Deliberately NOT mapped

• minLength / maxLength stay at 3100: existing openapi-backend services already expose 3100 there and Golden Path asserts it (quotes_negative). A guard test in this PR pins that behavior. Restoring full joi parity for these (incl. joi's any.empty → 3102 for empty strings) is a follow-up proposal with its own GP test updates.
• Numeric/array keywords (minimum, maximum, minItems, …) stay at 3100 — the joi switch never mapped them either; parity means restraint.

Validation

• 353/353 unit tests (5 new, incl. the minLength guard), lint + coverage gates green.
• Fleet-validated on ml-core-test-harness with 9 locally-built services consuming this branch (central-ledger, central-settlement, account-lookup-service, quoting-service, ml-api-adapter, als-msisdn-oracle-svc, bulk-api-adapter, als-oracle-pathfinder, event-sidecar): full Golden Path shows no regression vs the helm v18.1 (PR #819) release baseline; GP #956 passes 6/6.
• Known GP contract updates that accompany consumer adoption (already staged in a testing-toolkit-test-cases branch): 7 assertions flip 3100→3101 — "Test for Bugfix #742" (1, whose own title says 3101) and six "POST /quotes with missing parameters in body" requests — all of the class that codified the post-migration 3100.
• No fleet repo's unit tests pin 3100 to enum/format/pattern signatures (swept).

Release

fix: → patch (13.1.8), consistent with the #2013 precedent (released as 12.0.1). Consumers adopt via explicit dependency bumps; nothing changes for services pinned to ≤13.1.7.

Part of mojaloop/project#4479.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[elnyry-sam-k]

👍