fix(security): recompute document totals server-side (GHSA-8c69) (#665)

Invoice/estimate/recurring-invoice creation and update accepted total,
sub_total, tax and due_amount straight from the request with no server-side
recalculation, so a client could persist financial totals that don't match the
line items (and, on invoice update, corrupt the due-amount/paid-amount logic
which keyed off the client total).

- Adds App\Support\DocumentTotals which recomputes item totals (round(price *
  quantity) minus per-item discount) and document totals (sub_total, tax with
  per-item vs document and tax_included handling, total, due_amount), mirroring
  the front-end calculation. Only price/quantity/discounts/tax-line amounts are
  trusted.
- getInvoicePayload/getEstimatePayload/getRecurringInvoicePayload override the
  client totals with the recomputed values; createItems recomputes each stored
  item total; Invoice::updateInvoice keys its due-amount/paid-amount logic off
  the recomputed total instead of the request total.

Adds DocumentTotals unit tests + a feature test proving a tampered invoice
total is ignored. Existing create/update tests no longer assert the (now
server-authoritative) derived totals.

tests/Unit/DocumentTotalsTest.php

@@ -0,0 +1,79 @@
+<?php
+
+use App\Support\DocumentTotals;
+
+test('sums item totals from price and quantity, ignoring client-supplied item totals', function () {
+    $totals = DocumentTotals::compute(
+        [['price' => 10000, 'quantity' => 10, 'total' => 1, 'taxes' => []]],
+        [], 0, 'NO', false, 'NO'
+    );
+
+    expect($totals['sub_total'])->toBe(100000)
+        ->and($totals['total'])->toBe(100000)
+        ->and($totals['tax'])->toBe(0);
+});
+
+test('applies document discount and document-level tax', function () {
+    $totals = DocumentTotals::compute(
+        [['price' => 1000, 'quantity' => 2]],
+        [['amount' => 150]],
+        500, 'NO', false, 'NO'
+    );
+
+    // 2000 - 500 + 150
+    expect($totals['sub_total'])->toBe(2000)
+        ->and($totals['tax'])->toBe(150)
+        ->and($totals['total'])->toBe(1650);
+});
+
+test('uses per-item taxes (not document taxes) when tax_per_item is YES', function () {
+    $totals = DocumentTotals::compute(
+        [
+            ['price' => 1000, 'quantity' => 1, 'taxes' => [['amount' => 100]]],
+            ['price' => 2000, 'quantity' => 1, 'taxes' => [['amount' => 200]]],
+        ],
+        [['amount' => 9999]],
+        0, 'YES', false, 'YES'
+    );
+
+    expect($totals['sub_total'])->toBe(3000)
+        ->and($totals['tax'])->toBe(300)
+        ->and($totals['total'])->toBe(3300);
+});
+
+test('excludes tax from total when tax_included', function () {
+    $totals = DocumentTotals::compute(
+        [['price' => 1000, 'quantity' => 1]],
+        [['amount' => 100]],
+        0, 'NO', true, 'NO'
+    );
+
+    expect($totals['total'])->toBe(1000)->and($totals['tax'])->toBe(100);
+});
+
+test('applies per-item discount only when discount_per_item is YES', function () {
+    $with = DocumentTotals::compute(
+        [['price' => 1000, 'quantity' => 2, 'discount_val' => 300]],
+        [], 0, 'NO', false, 'YES'
+    );
+    $without = DocumentTotals::compute(
+        [['price' => 1000, 'quantity' => 2, 'discount_val' => 300]],
+        [], 0, 'NO', false, 'NO'
+    );
+
+    expect($with['sub_total'])->toBe(1700)
+        ->and($without['sub_total'])->toBe(2000);
+});
+
+test('supports negative quantities', function () {
+    $totals = DocumentTotals::compute(
+        [
+            ['price' => 100, 'quantity' => -2],
+            ['price' => 50, 'quantity' => 1],
+            ['price' => 75, 'quantity' => 0],
+        ],
+        [], 0, 'NO', false, 'NO'
+    );
+
+    expect($totals['sub_total'])->toBe(-150)->and($totals['total'])->toBe(-150);
+});