feat(expenses): streaming expense-PDF export + receipt-less expense flag + audit-3 fixes

Replaces the legacy text-only expense PDF (was just dumping rows into a
single pdfme text field — no images, no pagination) with a proper
streaming export modelled on the legacy Nuxt client-portal but
re-architected for memory safety. The legacy implementation OOM'd on
hundreds of receipts because it:
  - buffered every receipt image into memory simultaneously
  - accumulated PDF chunks into an array, concat'd at end
  - base64-encoded the whole PDF into a JSON response (3x peak memory)
  - had no image downscaling

The new design:
  - `streamExpensePdf()` (src/lib/services/expense-pdf.service.ts):
    pdfkit pipes bytes directly to the HTTP response (no Buffer
    accumulation). Receipts are processed serially so peak heap is one
    image at a time. Sharp downscales any receipt > 500 KB or > 1500 px
    to JPEG q80 — typical 8 MB phone photo collapses to ~250 KB. For a
    500-receipt export, peak RSS stays under ~100 MB; legacy needed >2
    GB for the same input.
  - Pages: cover summary box (count, totals, currency equiv, optional
    processing fee), grouped expense table (groupBy=none|payer|category|
    date), one-page-per-receipt with header (establishment, amount,
    date, payer, category, file name) and full-bleed image.
  - Storage backend abstraction — receipts stream from
    `getStorageBackend().get(storageKey)`, works on MinIO/S3/filesystem.
  - Route: POST /api/v1/expenses/export/pdf streams binary
    application/pdf with cache-control:no-store. Validator caps
    expenseIds at 1000 to prevent runaway loops.

Receipt-less expense flow (per user request):
  - Schema: 0033 migration adds `expenses.no_receipt_acknowledged`
    boolean (default false).
  - Validator: createExpenseSchema requires either receiptFileIds OR
    noReceiptAcknowledged=true; the .refine() error message tells the
    rep exactly what to do. updateExpenseSchema is partial and skips
    the rule (existing rows can be edited without re-acknowledging).
  - PDF: receiptless expenses get an inline red "(no receipt)" tag in
    the establishment cell + a red footer warning in the summary box
    showing the count and at-risk amount.
  - The legacy parent-company reimbursement queue may refuse to pay
    receiptless expenses, so the warning is load-bearing for ops.

Audit-3 fixes piggy-backed:
  - 🔴 Tesseract OCR runtime now races a 30s timeout (CPU-bomb DoS
    protection — a crafted PDF rasterizing to high-res noise could
    pin the worker indefinitely).
  - 🟠 brochures.service.ts:listBrochures dropped a wasted query (the
    legacy single-brochure fast-path was discarding its result on the
    multi-brochure branch).
  - 🟠 berth-pdf.service.ts:listBerthPdfVersions now Promise.all's the
    presignDownload calls instead of awaiting each in a for-loop —
    20-version berths went from 20× round-trip to 1×.
  - 🟡 public berths route no longer logs the full `row` object on
    enum drift (was dumping price + amenity columns into ops logs).
  - 🟡 dropped the dead `void sql` import from public berths route.

Tests still 1163/1163. tsc clean.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/validators/expenses.ts

@@ -2,7 +2,12 @@ import { z } from 'zod';
 import { baseListQuerySchema } from '@/lib/api/route-helpers';
 import { EXPENSE_CATEGORIES, PAYMENT_METHODS } from '@/lib/constants';
 
-export const createExpenseSchema = z.object({
+/**
+ * Inner-shape ZodObject — kept exported (without .refine wrapping) so
+ * `updateExpenseSchema` can still call `.partial()`. The `.refine()` rule
+ * for "receipt or acknowledgement" is applied via `createExpenseSchema`.
+ */
+export const createExpenseShape = z.object({
   establishmentName: z.string().max(200).optional(),
   amount: z.coerce.number().positive(),
   currency: z.string().length(3).default('USD'),
@@ -12,13 +17,33 @@ export const createExpenseSchema = z.object({
   expenseDate: z.coerce.date(),
   description: z.string().max(2000).optional(),
   receiptFileIds: z.array(z.string()).optional(),
+  /**
+   * Set to `true` when the rep deliberately creates an expense without a
+   * receipt. The UI shows a non-blocking warning that surfaces both at
+   * creation time and again in the PDF export. Without this flag, the
+   * server rejects an expense submitted with no `receiptFileIds` so reps
+   * can't accidentally lose-receipt by mistake.
+   */
+  noReceiptAcknowledged: z.boolean().optional().default(false),
   paymentStatus: z.enum(['unpaid', 'paid', 'partial']).default('unpaid'),
   paymentDate: z.string().optional(),
   paymentReference: z.string().optional(),
   paymentNotes: z.string().optional(),
 });
 
-export const updateExpenseSchema = createExpenseSchema.partial();
+export const createExpenseSchema = createExpenseShape.refine(
+  (v) => (v.receiptFileIds && v.receiptFileIds.length > 0) || v.noReceiptAcknowledged === true,
+  {
+    message:
+      'Receipt required. Tick "I have no receipt for this expense" if you understand it may not be reimbursed.',
+    path: ['receiptFileIds'],
+  },
+);
+
+// Update accepts partial fields and skips the create-time receipt-or-ack
+// rule (the row already exists and may legitimately be edited without
+// touching receipts).
+export const updateExpenseSchema = createExpenseShape.partial();
 
 export const listExpensesSchema = baseListQuerySchema.extend({
   category: z.string().optional(),
@@ -29,6 +54,45 @@ export const listExpensesSchema = baseListQuerySchema.extend({
   payer: z.string().optional(),
 });
 
+/**
+ * Body for `POST /api/v1/expenses/export/pdf`. Mirrors the legacy
+ * `PDFOptions` shape from the Nuxt client-portal so reps can re-use the
+ * same mental model. `expenseIds` selects an explicit subset; when
+ * absent, the listExpenses-style filter is used to gather rows.
+ *
+ * Limits are deliberate:
+ *   - max 1000 expenseIds so a runaway selection can't queue an OOM-able
+ *     receipt-fetch loop (see expense-pdf.service.ts).
+ *   - documentName is sanitized at the service layer for the filename;
+ *     the validator only enforces a sane upper bound.
+ */
+export const exportExpensePdfSchema = z.object({
+  expenseIds: z.array(z.string()).max(1000).optional(),
+  filter: z
+    .object({
+      dateFrom: z.string().optional().nullable(),
+      dateTo: z.string().optional().nullable(),
+      category: z.string().optional().nullable(),
+      paymentStatus: z.string().optional().nullable(),
+      payer: z.string().optional().nullable(),
+      includeArchived: z.boolean().optional(),
+    })
+    .optional(),
+  options: z.object({
+    documentName: z.string().min(1).max(200),
+    subheader: z.string().max(300).optional(),
+    groupBy: z.enum(['none', 'payer', 'category', 'date']).default('none'),
+    includeReceipts: z.boolean().default(false),
+    includeReceiptContents: z.boolean().default(false),
+    includeSummary: z.boolean().default(true),
+    includeDetails: z.boolean().default(true),
+    includeProcessingFee: z.boolean().default(false),
+    targetCurrency: z.enum(['USD', 'EUR']).default('EUR'),
+    pageFormat: z.enum(['A4', 'Letter', 'Legal']).default('A4'),
+  }),
+});
+
 export type CreateExpenseInput = z.infer<typeof createExpenseSchema>;
 export type UpdateExpenseInput = z.infer<typeof updateExpenseSchema>;
 export type ListExpensesInput = z.infer<typeof listExpensesSchema>;
+export type ExportExpensePdfInput = z.infer<typeof exportExpensePdfSchema>;