Add issue/cancel lifecycle, GST derivation and integer-paise totals

issue_invoice allocates the number, freezes vendor and bank details and
stores server-computed totals in one transaction. Issued invoices are
cancelled, not deleted. Tax heads derive from supplier state and place of
supply (a disagreeing choice is rejected); unregistered suppliers issue a
plain Invoice. Adds GSTIN checksum validation, canonical India Compliance
state list, server-side drafts, series validation, relative and
magic-byte-checked asset paths, and GST settings. PDF re-exports use the
frozen vendor snapshot.

src/lib/validators.test.ts

@@ -0,0 +1,27 @@
+import { describe, expect, it } from "vitest";
+import { gstinChecksumError, gstinFullError, vendorGstinError } from "./validators";
+
+// Same GSTINs as the Rust tests in src-tauri/src/gst.rs.
+describe("GSTIN checksum", () => {
+  it("accepts valid GSTINs", () => {
+    expect(gstinChecksumError("27AAPFU0939F1ZV")).toBeUndefined();
+    expect(gstinChecksumError("07AAGFF2194N1Z1")).toBeUndefined();
+    expect(gstinChecksumError("29ABCDE1234F1ZW")).toBeUndefined();
+  });
+
+  it("rejects a wrong check digit and bad shapes", () => {
+    expect(gstinChecksumError("29ABCDE1234F1Z5")).toMatch(/expected W/);
+    expect(gstinChecksumError("27AAPFU0939F1ZX")).toMatch(/check digit/);
+    expect(gstinChecksumError("27AAPFU0939F1Z")).toMatch(/15-character/);
+  });
+
+  it("cross-checks the PAN and the state", () => {
+    expect(gstinFullError("27AAPFU0939F1ZV", "AAPFU0939F")).toBeUndefined();
+    expect(gstinFullError("27AAPFU0939F1ZV", "AAPFU0939G")).toMatch(/PAN/);
+    expect(gstinFullError("")).toBeUndefined();
+    expect(vendorGstinError("unregistered", "", "", "29")).toBeUndefined();
+    expect(vendorGstinError("regular", "", "", "27")).toMatch(/needs a GSTIN/);
+    expect(vendorGstinError("regular", "27AAPFU0939F1ZV", "AAPFU0939F", "29")).toMatch(/state code/);
+    expect(vendorGstinError("regular", "27AAPFU0939F1ZV", "AAPFU0939F", "27")).toBeUndefined();
+  });
+});