fix(security): recompute document totals server-side (GHSA-8c69) (#665)

Invoice/estimate/recurring-invoice creation and update accepted total,
sub_total, tax and due_amount straight from the request with no server-side
recalculation, so a client could persist financial totals that don't match the
line items (and, on invoice update, corrupt the due-amount/paid-amount logic
which keyed off the client total).

- Adds App\Support\DocumentTotals which recomputes item totals (round(price *
  quantity) minus per-item discount) and document totals (sub_total, tax with
  per-item vs document and tax_included handling, total, due_amount), mirroring
  the front-end calculation. Only price/quantity/discounts/tax-line amounts are
  trusted.
- getInvoicePayload/getEstimatePayload/getRecurringInvoicePayload override the
  client totals with the recomputed values; createItems recomputes each stored
  item total; Invoice::updateInvoice keys its due-amount/paid-amount logic off
  the recomputed total instead of the request total.

Adds DocumentTotals unit tests + a feature test proving a tampered invoice
total is ignored. Existing create/update tests no longer assert the (now
server-authoritative) derived totals.

tests/Unit/EstimateTest.php

@@ -66,12 +66,9 @@ test('create estimate', function () {
         'estimate_number' => $estimate['estimate_number'],
         'customer_id' => $estimate['customer_id'],
         'template_name' => $estimate['template_name'],
-        'sub_total' => $estimate['sub_total'],
-        'total' => $estimate['total'],
         'discount' => $estimate['discount'],
         'discount_type' => $estimate['discount_type'],
         'discount_val' => $estimate['discount_val'],
-        'tax' => $estimate['tax'],
         'notes' => $estimate['notes'],
     ]);
 });
@@ -114,12 +111,9 @@ test('update estimate', function () {
         'estimate_number' => $newEstimate['estimate_number'],
         'customer_id' => $newEstimate['customer_id'],
         'template_name' => $newEstimate['template_name'],
-        'sub_total' => $newEstimate['sub_total'],
-        'total' => $newEstimate['total'],
         'discount' => $newEstimate['discount'],
         'discount_type' => $newEstimate['discount_type'],
         'discount_val' => $newEstimate['discount_val'],
-        'tax' => $newEstimate['tax'],
         'notes' => $newEstimate['notes'],
     ]);
 });