Secure expense receipts by wiring Media Library to FileDisk

Spatie Media Library now uses the default FileDisk (local_private) for
new uploads instead of the public disk. Expense receipts are no longer
directly web-accessible.

- AppServiceProvider configures media-library disk from FileDisk on boot
- Change media-library fallback from 'public' to 'local'
- Expense receipt URL accessor returns authenticated route instead of
  direct file URL
- Add registerMediaCollections() to Expense model
- Prevent deleting FileDisk that contains files or is a system disk
- Add media:secure command to migrate existing receipts to private disk

Fixes #187

app/Models/Expense.php

@@ -42,6 +42,11 @@ class Expense extends Model implements HasMedia
         ];
     }
 
+    public function registerMediaCollections(): void
+    {
+        $this->addMediaCollection('receipts');
+    }
+
     public function category(): BelongsTo
     {
         return $this->belongsTo(ExpenseCategory::class, 'expense_category_id');
@@ -92,7 +97,7 @@ class Expense extends Model implements HasMedia
 
         if ($media) {
             return [
-                'url' => $media->getFullUrl(),
+                'url' => '/reports/expenses/'.$this->id.'/receipt',
                 'type' => $media->type,
             ];
         }