feat(expenses): receipts — validated private image/PDF (part of #71)

[vibhavkatre]

Part of #71. Adds receipts to expenses (the deferred bulk of #71; live ECB auto-conversion is the small remainder).

Attach an optional image or PDF receipt to any expense. Security-critical, so built by hand and reusing the Audio file-validation pattern:

• Validated by magic bytes (toolbox/receipt_files.py) — never the client's claimed MIME/filename — against an allowlist (JPEG/PNG/GIF/WebP/PDF), size-capped at 10 MB.
• Stored as a private Frappe File attached to the owner's expense; the endpoint is owner-checked + rate-limited.
• Attaching a new receipt replaces the old file; remove or deleting the expense deletes the file (no orphans).

Frontend

Receipt control in the expense form (attach once saved; view/remove an existing one) and a "Receipt" chip on ledger rows linking to the private file. The composable reads the file to base64, calls the validated endpoint, and updates the form + list in place.

Tests & verification

• Backend: 8 tests (magic-byte detect accept/reject, private-file create, non-receipt rejected, replace-removes-old, remove clears+deletes, expense-delete removes file, cross-user rejection). Expense-module backend now 49 tests.
• Frontend: +1 composable test; full suite 652 passing; build clean.
• Verified live: an expense with a receipt shows the 📎 Receipt chip on its row; the row links to the private file.

Note: Frappe runs its own PIL/pypdf scan on image/PDF uploads (rejecting unparseable or JS-bearing files), which layers on top of the magic-byte allowlist.

🤖 Generated with Claude Code