Security & Reliability Hardening Audit — Python/FastAPI multi-tenant platform (payments, PII)

We've built an integrated B2B travel/tourism platform — Python · FastAPI · SQLite→Postgres, with operator/reseller/internal-console fronts, a settlement & payments engine, multi-tenant isolation, and PII/PDPL handling. It's fully built and the test suite is green (6,000+ tests), but much of it was AI-built and I want an experienced engineer to independently audit and harden it before we take real money. Deliverable — a prioritized P0/P1/P2 findings report with reproductions + recommended fixes (PRs for the top items) across: • Security — auth/session, multi-tenant isolation (app + DB), the payment/webhook paths, secrets, injection/XSS, rate-limiting • Data & compliance — PII handling, data privacy (PDPL/GDPR-style), cross-border transfer, retention • Correctness — the settlement/refund money logic (highest-stakes), and whether the green tests are meaningfully green • Reliability & code quality — error handling, N+1s, oversized functions, resilience NDA required (proprietary codebase); access is a scoped read-only copy with no production secrets.