fix(flags): close CRM/accounting feature-gating gaps from the audit

A sweep of every CRM/accounting toggle found surfaces still reachable
with their flag OFF. Adds a shared requireFeatureFlag middleware (the two
existing per-file copies predate it) and closes the gaps:

- Hours logging: only createEntry checked the flag — edit/delete/bill and
  the list/summary routes were permission-only. Gate all six
  /hour-entries routes on the hoursLogging master so a disabled feature
  can't be read, mutated, or invoiced via a direct API hit.
- Installment plans: PUT /deals/:uuid/installment-plan mutates invoices
  but wasn't bills-gated; add requireFeatureFlag('bills').
- Customer invoice PDF: /invoices/:id/pdf lacked the feature_bills check
  the list + quotes routes have. Also fixes the quotes-PDF gate, which
  read req.customer.feature_quotes (never populated → silent no-op).
- Customer contracts: /contracts + /contracts/:id/pdf were gated by
  neither the master nor a per-customer column.

Per-customer contracts override (the missing counterpart):
- Migration 131 adds customer_accounts.feature_contracts, default TRUE so
  existing customers keep their Contracts tab (preserve-visuals).
- Effective resolver now contractsMaster AND feature_contracts; admin
  detail page gains the toggle; service/validator/serializer wired.

Cleanups:
- Drop stale `taxReport` from the sidebar's Clients-reveal list (Tax moved
  to Accounting); add the missing `projects` so it mirrors the context
  derivation.
- SettingsPage tab-snap effect now depends on flags.accounting.
- Fix stale taxReport "forced off when bills off" comment (it's accounting).

frontend/src/components/admin/AdminSidebar.tsx

@@ -92,9 +92,12 @@ const navigation: NavItem[] = [
     // can't disagree: any sub-feature on lights up the entry, all off
     // hides it. Future siblings (e.g. `messaging`) get appended here
     // AND in the context derivation.
+    // taxReport intentionally excluded — Tax moved to the Accounting section
+    // and is not a Clients sub-nav item, so it must not reveal Clients (would
+    // open an empty ClientsLayout). Mirrors the context's `clients` derivation.
     featureFlagsAny: [
       'customerPortal', 'crmDevelopment', 'quotes', 'bills',
-      'taxReport', 'hoursLogging', 'contracts', 'calendar',
+      'hoursLogging', 'contracts', 'calendar', 'projects',
     ],
   },
   // Accounting section (migration 122) — inbound supplier invoices,