parity(apps+api): report + report/detail on the internal ledger [ref: henza_pwa views/report]

Ports "گزارش" end to end (D24), the last missing app page.

In the reference this feature computes nothing: Customer\TahesabController
proxies an external accounting system (hesab.henzagold.com and a bare IP at
31.7.68.147:3030) with TLS verification disabled, a bearer token hardcoded in
the source and a URL-embedded secret, keyed on Customer.mcode. The target has
no such system and no mcode, so per the owner's option الف this is built on our
own ledger with no external connection.

API — customer/me/report{,/detail,/balances,/:id}
- one row per CONFIRMED ledger entry with the running gold and rial balance
  after it, newest first as the reference displayed it
- only confirmed entries count, the same rule the cached
  Customer.goldDebtGrams/fiatDebtRial follow, so the statement's closing
  balance agrees with the figure shown everywhere else in the app
- fields the target has no source for (foreign currency, نام کارساخته,
  جنس فلز, the external system's internal ids) are null/zero and the UI OMITS
  the row rather than rendering a fabricated value (REP-01)

SEC-16, NOT ported: the reference's detail($id) took the factor code from the
URL and performed no ownership check at all — it never consults auth() — so any
signed-in customer could read any other customer's document by guessing a code.
Here the id is only a filter on top of a customerId scope from the token.
Tested in both directions.

Apps (both, template+script byte-identical, per-app styling only)
- ReportView with the reference's two tabs, its card rows and its «جزئیات»
  modal; ReportDocument for one document
- routes /report and /report/detail, the latter opening the second tab
- dashboard entry (v1 tile, v2 row), shown to every signed-in customer since
  the reference's hasMCode() gate has no target equivalent

Verified: build 5/5 · jest 45/45 · report 40/40 (new) ·
complete-profile 38/38 · apps smoke 43/43 · typecheck clean on all four apps.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/parity/DECISIONS.md

@@ -1301,3 +1301,40 @@ clear warning; the lower-risk option was chosen (D19), since failing the boot
 could take down a running deployment that has not set the variable yet. A
 banner as loud as the master-OTP one now fires at boot, and DELIVERY.md lists
 it as the **first** pre-release step (REL-03).
+
+## D24 — «گزارش» (report + report/detail) on the internal ledger, 2026-09-23
+
+**In the reference this feature computes nothing.** `Customer\TahesabController`
+(henza_server `app/Http/Controllers/Customer/TahesabController.php`) forwards
+every call to an external accounting system — `hesab.henzagold.com` and a bare
+IP at `31.7.68.147:3030` — with `Http::withoutVerifying()` (TLS verification
+off), a bearer token hardcoded in the source and a URL-embedded `sfx` secret,
+keyed on `Customer.mcode`, the customer's id in that other system. The PWA
+renders whatever comes back.
+
+The target has no such system and no `mcode`. **The owner chose option الف:**
+build the reference's UI and flow over our own ledger, with no external
+connection. So `customer/me/report*` reproduces the statement's SHAPE — the
+field names `henza_pwa/src/type/accounting.ts` declares, so the ported
+components bind unchanged — from `LedgerEntry`.
+
+**Honesty rule.** Every figure is computed from confirmed ledger entries.
+Where the external system carried a column the target has no equivalent for
+(foreign currency, وزن پلاستیک, نام کارساخته, جنس فلز and its internal
+bookkeeping ids), the field is `null`/zero and the UI **omits the row** rather
+than rendering a fabricated value. Recorded as REP-01.
+
+**Two things the target does better, deliberately:**
+- Only **confirmed** entries count, the same rule the cached
+  `Customer.goldDebtGrams` / `fiatDebtRial` follow — so the statement's closing
+  balance agrees with the figure shown everywhere else in the app. Asserted by
+  the test.
+- **SEC-16:** the reference's `detail($id)` took the factor code from the URL
+  and performed **no ownership check whatsoever** — it never looks at `auth()`
+  — so any signed-in customer could read any other customer's document by
+  guessing a code. Here the id is only ever a filter on top of a `customerId`
+  scope, so someone else's id returns nothing. Tested in both directions.
+
+The reference gated the page on `myStore.hasMCode()`; with no mcode in the
+target the gate is simply a session, and the server scopes every row to the
+token.