Finance permissions

• finance.view: view overview metrics and all finance registers/details.
• finance.manage: create/edit Draft invoices and expenses, add invoice items/schedules, record payments, submit expenses, and mark Approved invoices Sent.
• finance.approve: approve invoices and expenses, confirm/reject/reverse payments, issue receipts, mark approved expenses Paid, and waive/cancel schedule rows.

Every page checks finance.view on the server. Every mutation checks its specific permission again; hiding a button is not treated as authorization. Finance events use the shared ActivityLog with actor, action, entity, description, and context.