feat: Multiple Bank Accounts (IBAN/BIC) by contract

[aaronspring]

Closes #510

What

Support multiple bank accounts (IBAN/BIC) per user, with a default account used for invoicing and the option to pin a specific account onto a contract.

• Model: User.bank_accounts (list) replaces the single bank_account_id column; is_default flags the account used when a contract names none. Contract.bank_account_id selects the account invoices for that contract pay into.
• Migration f87515d1d068: backfills bankaccount.user_id from the old 1:1 link and marks the previously linked account as default, then drops user.bank_account_id. FKs: bankaccount.user_id → CASCADE, contract.bank_account_id → SET NULL.
• Invoicing: e-invoice payee and rendered invoices resolve the contract's bank account first, falling back to the user's default account (einvoice.py, rendering.py, all template scripts).
• App: Settings → Profile has a multi-account editor (default radio, add/remove); the contract form offers an "Invoicing Bank Account" dropdown. Removing an account a contract still invoices from is refused by update_profile and surfaced in the profile status bar.
• Demo: Harry Tuttle gets two accounts — a default one and a USD one; his USD security contract pays into the USD account.

Verification

• uv run pytest — 558 passed, 1 skipped.
• cd ui && npm run build (tsc + vite) — clean.
• Migration, exercised against a DB seeded at the previous head (9cad5ae77a79) with the old 1:1 link, an unreferenced leftover account, and a contract:
  • the linked account becomes user_id=1, is_default=1; the unreferenced one is kept as user_id=NULL, is_default=0 (not deleted);
  • user.bank_account_id is dropped with no row loss, PRAGMA foreign_key_check is empty, no _alembic_tmp_* residue;
  • both new FKs survive the batch rebuild with CASCADE / SET NULL intact.
  • New tests in tuttle_tests/test_migrations.py pin all of the above; they were mutation-checked (breaking the backfill fails them).
• UI smoke (Electron via Playwright): Settings → Profile lists both accounts with the default radio and "Add bank account" grows the list; Contracts → New offers both accounts in "Invoicing Bank Account".

Notes

• Migration is append-only per tuttle/migrations/README.md; the generated revision was reviewed (no rename-as-drop traps, data backfill preserved).
• Accounts orphaned by pre-migration profile edits keep user_id=NULL and are not shown in the UI. They are preserved in the DB, not deleted.
• Account deletion goes through delete-orphan on User.bank_accounts, so the in-use check in update_profile is what protects contracts from losing their account.

[aaronspring]

UI verification — multiple bank accounts

Focused Electron smoke on PR #511 using the Harry Tuttle demo user.

Settings → Profile — multiple accounts

The new Bank Accounts card shows the default-account radio, account details, and the add-account flow.

Contracts → New — per-contract account selection

The contract form exposes “Invoicing Bank Account”, with “Use my default account” as the safe fallback.

Invoice — non-default account

The Harry Tuttle demo’s USD invoice for Ductwork Security Inc. renders with the dedicated Wise USD account rather than the default Giro account.

Invoice 2026-06-26-1 · $1,000.00 · account Wise USD.

Checks

• Launch: Electron via ui/driver.mjs
• Navigation: Settings → Profile; Contracts → New; Invoicing → invoice 2026-06-26-1
• Synthetic data only: Harry Tuttle demo user, Giro + Wise USD accounts
• Existing PR checks: uv run pytest (446 passed) and cd ui && npm run build (clean)
• Limitation: this was a focused macOS smoke; final UX review and other platform packaging paths remain for human review.

[aaronspring]

Note: Account name shouldn't be set to giro or wise USD (internal account names) but to Account Owner/Business name.