Create a pending ACH debit authorization for an inbound debit against a virtual account.
Find a pending ACH_PULL withdrawal by achId and reconcile it with the given bank transaction.
When no authorization exists the debit has still settled, so this creates
the same one the Pending webhook would have. That webhook is the only
thing that normally opens the authorization, and a dropped delivery used to
leave the bank transaction unreconciled and skip the FBO -> vacct sweep,
which runs inside the withdrawal workflow and is keyed on the withdrawal.
Callers must therefore only reach here for debits they have already
established are real (see isAllZeroAchTrace on the webhook path).
Service responsible for handling withdrawal reconciliation operations.
Only use this if the withdrawal method maps 1:1 with a bank transaction.