Add the ERPNext integration foundation (Phase F1)

- New integrations module with an InvoiceSink seam and an ERPNext client built on reqwest with rustls (ring provider only; aws-lc is not in the dependency graph). Token auth, timeouts, retry with backoff on 429, 5xx and timeouts (POSTs only when idempotent), optional extra CA, and a rule that plain http is allowed only for localhost-style hosts.
- Error extraction for Frappe v1 and v2 bodies, version and India Compliance discovery, live option loaders, and a connection test that returns warnings instead of failing.
- Pure, snapshot-tested mapping from a stored invoice to a Sales Invoice (CGST+SGST, IGST, unregistered, discount, code-less rows, mirrored and series naming) that refuses to produce a payload whose totals differ from Voiced's.
- Migration M10 adds erpnext_config (the API secret is never returned to the webview), erpnext_sync and the nullable ERPNext link columns.
- Commands to get and save the config, test the connection and load options, with typed wrappers. No UI and no push yet.

The API secret is stored in the SQLite file, so backups contain it. Nothing has run against a live ERPNext yet.

src-tauri/src/integrations/erpnext/mod.rs

@@ -0,0 +1,14 @@
+//! ERPNext / Frappe integration. All HTTP runs in Rust (see `client`); `mapping` is pure and
+//! snapshot-tested; `config` owns the stored settings and the API secret.
+
+// Parts of this module are consumed by the push commands in the next step.
+#![allow(dead_code)]
+
+pub mod client;
+pub mod config;
+pub mod discovery;
+pub mod errors;
+pub mod mapping;
+
+#[cfg(test)]
+pub(crate) mod testutil;