fix(accounting): PR #622 concerns — flag-cache, customer master gate, VAT-unconfigured, helpers, page cap

1. requireFeatureFlag now caches each flag for 10s (the accounting area is 10+
   gated endpoints); PUT /admin/feature-flags invalidates the cache so toggles
   still take effect immediately.
2. Customer routes (/quotes, /invoices, /contracts + their PDFs) now gate via
   getEffectiveFeaturesForCustomer — the global MASTER flag AND the per-customer
   override — instead of the per-customer column alone, via a shared
   customerFeatureAllowed() helper. Admin disabling a feature globally is now
   honoured for customers too.
4. Tax-report VAT-payable: when accounting_vat_registered is UNSET, stop guessing
   from grandTotalVat>0 (a zero-output-VAT quarter silently flipped to "not
   registered" and hid the reclaim). Treat null as "not configured":
   vatPayableMinor=null + vatRegistrationConfigured=false; the UI renders "—" and
   a "configure VAT registration" warning. Tests updated.
5. Shared upsertAppSetting() in utils/appSettings — the two adminSettings upsert
   loops use it, so the app_settings created_at class can't be re-introduced.
6. PDF rasterise per-file bound: getRenderedPagePath refuses pages beyond
   MAX_RENDERABLE_PAGES (200); page_count is capped to match at ingest, so a
   hostile high-page PDF can't drive an unbounded pager.
7. (no code) original_filename is only rendered via auto-escaped JSX; the two
   dangerouslySetInnerHTML sites are admin-authored content — paranoia pass clean.

Concerns 3 (foreign-VAT reclaim-country) and 8 (imap_pass plaintext) are PR-reply
/ doc items, addressed in the PR response, not code.

backend/__tests__/services/taxReportService.test.js

@@ -371,7 +371,9 @@ describe('getTaxReport', () => {
     expect(out.summary).toMatchObject({
       incomeNetMinor: 10000, incomeVatMinor: 770, incomeGrossMinor: 10770,
       costNetMinor: 0, costVatMinor: 0, costGrossMinor: 0,
-      resultNetMinor: 10000, resultGrossMinor: 10770, vatPayableMinor: 770,
+      resultNetMinor: 10000, resultGrossMinor: 10770,
+      // VAT registration unconfigured in the test DB → refuse to compute payable.
+      vatRegistrationConfigured: false, vatPayableMinor: null,
     });
   });
 
@@ -433,7 +435,8 @@ describe('getTaxReport', () => {
     expect(out.summary).toMatchObject({
       incomeNetMinor: 100000, incomeVatMinor: 7700, incomeGrossMinor: 107700,
       costNetMinor: 25000, costVatMinor: 1540, costGrossMinor: 26540,
-      resultNetMinor: 75000, resultGrossMinor: 81160, vatPayableMinor: 6160,
+      resultNetMinor: 75000, resultGrossMinor: 81160,
+      vatRegistrationConfigured: false, vatPayableMinor: null,
     });
   });