feat: gate treasury as an org module and group money inputs

Link optional invoice and cheque settlements to cash accounts, and let superadmin enable the finance module per organization.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/web/src/layouts/AppLayout.vue

@@ -157,6 +157,11 @@ function cardAllowedForNav(card: {
   to?: string;
 }) {
   if (card.ownerOnly && auth.user?.role !== 'owner') return false;
+  const canTreasury = auth.user?.role === 'owner'
+    || auth.user?.role === 'admin'
+    || Boolean(auth.user?.permissions?.includes('treasury'))
+    || Boolean(auth.user?.permissions?.includes('treasury_payroll'));
+  if (card.to?.startsWith('/finance')) return canTreasury;
   if (card.admin && !canSettings.value && !canOpenTeamWhileViewing.value) return false;
   if (!moduleAllowed(card.module)) return false;
   if (