perf + tests(goals): share account-ids across velocity windows + cover gaps

- Family#savings_inflow_windows wraps the current/prior 30d sums in a
  single helper that memoizes the linked-account-id lookup. The KPI tile
  on the goals index used to run the join+pluck twice per request.
- Replace two instance_variable_set pokes and one any_instance.stubs in
  the goal/controller tests. Refetching the goal exercises the real
  request lifecycle and stops the tests from leaning on implementation
  details. The 'All caught up' assertion now relies on a real reached
  state (target 1 vs the depository fixture's 5000 balance) rather than
  stubbing :status.
- Add tests covering: hex format validation on Goal#color, AASM cache
  reset (display_status reads the new state on the same instance after
  pause!), negative pledge amount rejection, expire! no-op on already-
  expired pledge, cancel! NotOpenError on non-open pledge, sweep job
  idempotency on a second pass, and strong-params rejection of state /
  family_id on goal create.

app/controllers/goals_controller.rb

@@ -195,8 +195,9 @@ class GoalsController < ApplicationController
       currency = family.primary_currency_code
       today = Date.current
 
-      velocity_30d = family.savings_inflow_velocity(range: (today - 30)..today)
-      velocity_prior_30d = family.savings_inflow_velocity(range: (today - 60)..(today - 31))
+      windows = family.savings_inflow_windows(window_days: 30, now: today)
+      velocity_30d = windows[:current]
+      velocity_prior_30d = windows[:prior]
       delta_amount = velocity_30d - velocity_prior_30d
       delta_percent = velocity_prior_30d.zero? ? nil : ((delta_amount / velocity_prior_30d.abs) * 100).round(1)