refactor(accounting): make Accounting a master flag with sub-toggles

Replaces the earlier peer-`accounting` flag (which only *conditionally*
relocated Tax) with a cleaner top-level master + sub-toggle model, per design
discussion:

- `accounting` = explicit top-level MASTER (Settings -> Features). Off hides
  the whole Accounting section.
- Sub-toggles, gated under the master:
  - `taxReport` ("Tax export") moves PERMANENTLY out of CRM. Removed from the
    Clients sub-nav and from the derived `clients` flag. Now INDEPENDENT of
    Bills (per decision). Old /admin/clients/tax-report -> redirect to
    /admin/accounting/tax-report.
  - `incomingInvoices` (new) gates the supplier-invoice capture / expenses /
    re-bill feature; the /api/admin/expenses router now checks it.
- Dependency rules (backend + frontend): accounting off forces taxReport +
  incomingInvoices off; taxReport dropped from the clients derivation; the
  bills->taxReport rule removed.
- Preserve visuals: migration 122 rewritten to auto-enable `accounting` on
  installs that already had Tax on (so the tab doesn't vanish), and to seed
  `incomingInvoices` off. Verified with a SQLite harness (taxReport on ->
  accounting on; off -> off).
- Settings -> Features: new "Accounting" section with the master card + Tax
  export + Incoming invoices sub-cards (disabled until the master is on).
- i18n: navigation.accounting, accounting.*, settings.features.{accounting,
  incomingInvoices,taxReport.requiresAccounting}, sections.accounting (EN + DE,
  DE authored natively); Tax report relabelled "Tax export"/"Steuerexport".

Verified: node -c, migration-122 harness, en/de JSON valid, npm run build green.

frontend/src/contexts/FeatureFlagsContext.tsx

@@ -45,10 +45,12 @@ export const DEFAULT_FLAGS: FeatureFlags = {
   // Settings → Features once they've reviewed the seeded block
   // library with their lawyer.
   contracts: false,
-  // Accounting (migration 122). Top-level Accounting area (inbound
-  // supplier invoices, expenses + re-bill). When ON, the tax report
-  // moves out of the CRM sub-nav and under Accounting. Strictly opt-in.
+  // Accounting (migration 122). Top-level MASTER for the Accounting
+  // section (separate from CRM). Sub-features below require it.
   accounting: false,
+  // Incoming invoices (migration 124) — supplier-invoice capture +
+  // expenses + re-bill. Accounting sub-feature; requires `accounting`.
+  incomingInvoices: false,
 };
 
 export const FEATURE_FLAGS_QUERY_KEY = ['feature-flags'] as const;
@@ -80,7 +82,12 @@ function applyDependencyRules(flags: FeatureFlags): FeatureFlags {
   out.galleries = true;                            // foundation — always on
   if (out.quotes === false) out.bills = false;     // bills depend on quotes
   if (out.calendar === false) out.calendarBooking = false;  // booking depends on calendar
-  if (out.bills === false) out.taxReport = false;  // tax report depends on bills
+  // Accounting sub-features require the Accounting master. Tax export is
+  // independent of Bills now — it relocated permanently into Accounting.
+  if (out.accounting === false) {
+    out.taxReport = false;
+    out.incomingInvoices = false;
+  }
   // Clients parent flag is DERIVED from its children. Admins don't
   // toggle it directly — enabling any CRM-area sub-feature
   // (Accounts today; future Calendar / Quotes / Bills / Messaging)
@@ -91,11 +98,12 @@ function applyDependencyRules(flags: FeatureFlags): FeatureFlags {
     || out.crmDevelopment
     || out.quotes
     || out.bills
-    || out.taxReport
     || out.hoursLogging
     || out.contracts
     // Migration 137 — admin calendar lights up the Clients section.
     || out.calendar
+    // NOTE: taxReport is intentionally NOT here anymore — the Tax export
+    // moved permanently into the Accounting section (its own master).
     // future siblings: || out.messaging
   );
   return out;