major: sync payme updates across my local version

[cachebag]

Brings this repo up to date with the payme copy maintained in the rafael monorepo, then bumps every dependency to current latest.

Synced from rafael

Backend:

• Config reads PAYME_BIND and PAYME_STATIC_DIR instead of PORT; static
  dir is configurable rather than hardcoded to /app/static
• Fixed expenses carry forward from the previous month
• Fixed expense edits propagate to later open months
• Budget category changes are scoped to the month
• Deleting a category unlabels its transactions
• Items table rebuild is atomic
• Open months get a line for every live category
• Corrected fixed totals and averages in stats
• Persistent ordering and income paid dates
• New test suite: monthly_fixed_expenses_tests.rs

Frontend:

• Drag-and-drop list reordering via @dnd-kit (SortableList,
  ReorderControls, useSortableReorder)
• Persistent ordering and income paid date UI
• npm → bun (bun.lock replaces package-lock.json)
• index.css restyle
• API client update, lint fixes, date input padding fix, added vite-env.d.ts
• typescript pinned to ^6.0.3 (typescript-eslint does not support TS 7)

Docs/scripts:

• README, run.sh, and .env.example updated for bun and the new env vars

Adapted for this repo (files that only exist here)

• ci.yml: frontend job switched from setup-node/npm to setup-bun/bun
• Dockerfile: frontend stage node:26 → oven/bun:1.3, base images
  bookworm → trixie, PORT → PAYME_BIND/PAYME_STATIC_DIR
• docker-compose.yml: PORT → PAYME_BIND

Dependency updates

Backend:

• jsonwebtoken 10.4.0 → 11.0.0
• printpdf 0.9.1 → 0.12.5
• validator 0.20.0 → 0.21.0
• axum-test 18.7.0 → 21.0.0 (TestServer::new/build no longer return
  Result; removed two .unwrap() calls in tests)
• tokio 1.53.1, uuid 1.24.0, time 0.3.55, serde 1.0.229,
  serde_json 1.0.151, thiserror 2.0.19

Frontend:

• react/react-dom 19.2.8, recharts 3.10.1, lucide-react 1.28.0, vite 8.2.0,
  eslint 10.8.0, typescript-eslint 8.65.0, tailwindcss 4.3.3,
  @vitejs/plugin-react 6.0.5, @types/react 19.2.18, @types/react-dom 19.2.4,
  globals 17.9.0
• packageManager → bun@1.3.14
• typescript stays on 6.0.3 — 7.0.2 exists but typescript-eslint errors on it