Collapse Vault-bridge two-hop transfers in explorer views (all plugins); keep genuine faucets/sinks

Context

Many plugins move money through a per-plugin SYSTEM clearing account because they use the legacy Vault economy API (withdraw + deposit, no atomic transfer) — see PAR-158 (the forward fix for ChestShop). When the economic event is really a transfer (A pays B), it lands as two ledger txns bridged by the SYSTEM account, so the explorer shows "paid ChestShop System" / "received from ChestShop System" instead of the real counterparty, double-counts volume, and surfaces the SYSTEM accounts as whales (account #4 = 1.26M postings).

This issue is the read/presentation-layer cleanup only. We explicitly decided not to rewrite the ledger — it stays append-only and auditable.

This is NOT "hide all SYSTEM accounts" — it's per-event

Classification of the SYSTEM clearing accounts (prod, credits_in vs debits_out):

account	legs	net	nature
ChestShop System	1.26M	$0	transfer (buyer→seller)
PostmanPat	4.8k	$0	transfer ($23.2M postage)
Exams	73k	$0	transfer
nightcore	90k	$0	transfer
DemocracyRobbery	17.5k	$0	transfer (victim→robber)
CustomFishing / DeluxeMenus / DiscordSRV	—	$0	transfer
GriefPreventionUI	510	+$369,880 (debits_out=$0)	pure sink — claim blocks burned
GriefPrevention / GriefPrevGUI	—	+$21k / +$37k	sink-heavy
BountyHunters	2.1k	+$62k	mix (transfers + unclaimed sink)
MobsToEggs / Essentials / DemocracyPost	—	+$31k / +$14k / +$441	mix

A blanket "hide SYSTEM legs" would erase $369k of real claim-block spending from players' histories. So the rule is per economic event:

• Collapse when a player→SYSTEM leg has a matching SYSTEM→player leg for the same event (same SYSTEM account, equal amount, same message, tight time window) → present as one buyer→seller transfer and hide the SYSTEM legs.
• Preserve an unmatched single leg = genuine faucet (SYSTEM→player: exam/fishing/mob rewards = real money entering) or sink (player→SYSTEM: claim blocks = real money leaving) → keep showing as SYSTEM↔player.

Affected explorer surfaces

Account detail (txn list, counterparties, activity calendar), money-flow (the phantom SYSTEM↔PERSONAL arrows), economy stats / volume / velocity (stop double-counting), top earners, /me, search. Exclude the SYSTEM clearing accounts from per-account / "top accounts" / counterparty rollups.

Approach

A read-layer transform (DAL view/CTE or a service) that resolves the real counterparty by pairing legs through the sentinel-owned AccountType.SYSTEM accounts. Notes:

• Perf: pairing 1.26M+ legs on the fly is expensive — likely materialise the pairing (or restrict to bounded windows / lean on the read mirror, PAR-134). Collapsing also removes the #4 whale from the heavy account-detail queries (ties into PAR-157).
• Keep the raw REST/cursor feed (PAR-151) raw — it's substrate; external consumers want the actual ledger events. This collapse is explorer presentation only.
• Pairing ambiguity within a (message, amount) group is fine for aggregates/display, but don't assert a 1:1 in any audit/forensic view — show raw there.

Acceptance

• A ChestShop purchase shows buyer ↔ seller (no "ChestShop System") in the explorer; claim-block purchases still show player → GriefPreventionUI as a sink.
• money-flow no longer shows phantom SYSTEM↔PERSONAL transfer volume for the net-$0 plugins; volume/velocity aren't double-counted.
• SYSTEM clearing accounts don't appear as top accounts / counterparties.
• Faucet/sink legs (rewards, claim blocks, unclaimed bounties) are preserved and correctly attributed.

Follow-up to PAR-158 (forward fix) / relates to PAR-157 (account perf) and PAR-134 (read mirror).