Add fraud detection model plan

[shlbatra]

Summary

• Adds plan/fraud_model_plan.md — a draft implementation plan for a fraud detection system modeled on the existing iris pipeline.
• Key design choices: LightGBM model with Optuna hyperparameter tuning in the KFP training pipeline, and a low-latency Cloud Run FastAPI real-time inference path (replacing the Dataflow inference hop) targeting <50ms p95.
• Feature engineering across users + transfers (velocity, amount aggregation, cross-border, diversity features) via BQ window functions, with a time-bucketed streaming refresh.
• Reorganizes existing design docs from docs/ into plan/.

Decisions captured

• LightGBM over XGBoost; threshold stored in a BQ config table; global-average defaults for cold-start users; hourly time-bucketed feature aggregation; feature-drift monitoring deferred.

Status

This is a plan for review, not an implementation. The doc ends with a "Review Findings — To Address" section (entity-granularity split, train/test leakage, point-in-time SQL correctness, synthetic-label signal, etc.) to resolve before writing code.

🤖 Generated with Claude Code