Split floats→safe_count, reports→cash_summary, add history cap

Adds three new granular capabilities:
- history: gates /history page and GET /api/cashup/history
- cash_summary: gates /summary page and GET /api/reports/cash-summary
- safe_count: gates /safe page and safe_cash float routes

Updates legacy-token fallback to include all seven non-settings caps.
Route guards and nav items updated to use the split caps.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/auth.js

@@ -37,7 +37,7 @@ export async function requireAuth(request, reply) {
     // Legacy token issued before granular capabilities existed. Reproduce the
     // old behaviour: full access except settings (which was is_admin-gated).
     // These users get precise capabilities the next time they log in.
-    caps = ['count', 'finalise', 'reports', 'floats']
+    caps = ['count', 'finalise', 'history', 'reports', 'cash_summary', 'floats', 'safe_count']
   }
 
   request.user = {