Enforce granular capabilities across cashup

Backend (server-side enforcement, not just UI):
- auth.js: read caps from JWT; hasCap() + requireCap() helpers;
  legacy-token fallback (full access minus settings) so existing
  sessions keep working until re-login
- finalise: submit final, delete draft, bulk-finalise, attachments
- reports: multiday report, cash summary, debtors
- floats: float management + safe count
- settings: settings mutations (was is_admin)
- count: draft save, newbook fetch

Frontend:
- can(user, cap) helper; User.caps from /verify
- Nav items, routes and actions (Submit Final, delete, bulk-finalise)
  gated on capabilities; non-finalisers see a draft-only hint

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

frontend/src/types.ts

@@ -1,7 +1,15 @@
+export type CashupCap = 'count' | 'finalise' | 'reports' | 'floats' | 'settings'
+
 export interface User {
   email: string
   name: string
   is_admin: boolean
+  caps: CashupCap[]
+}
+
+// Admins implicitly hold every capability.
+export function can(user: User, cap: CashupCap): boolean {
+  return user.is_admin || (user.caps?.includes(cap) ?? false)
 }
 
 export interface CashUp {