feat(accounting): document colleague trades on configured accounts

Post Montzar-covered buy/sell to Zarin/Tahesab/Pargar using montzar_account_* settings, and harden public storage URL/MIME handling for uploads.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Models/File.php

@@ -51,7 +51,9 @@ class File extends Model
         $trimmed = trim($path);
 
         if (preg_match('/^https?:\/\//i', $trimmed)) {
-            return self::rewriteWrongPublicUrl($trimmed) ?? $trimmed;
+            $rewritten = self::rewriteWrongPublicUrl($trimmed) ?? $trimmed;
+
+            return self::preferHttpsUrl($rewritten);
         }
 
         $relative = self::normalizeRelativeStoragePath($trimmed);
@@ -163,7 +165,16 @@ class File extends Model
             $base = 'https://'.ltrim($base, '/');
         }
 
-        return $base;
+        return self::preferHttpsUrl($base);
+    }
+
+    private static function preferHttpsUrl(string $url): string
+    {
+        if (str_contains($url, 'localhost') || str_contains($url, '127.0.0.1')) {
+            return $url;
+        }
+
+        return (string) preg_replace('/^http:\/\//i', 'https://', $url);
     }
 
     private static function baseUrlFromSettings(): string