feat(accounting): VAT registration/reclaim settings + un-gated VAT-codes read

Slice 1 of the VAT consolidation backend:
- PUT /admin/settings/accounting accepts accounting_vat_registered (bool) +
  accounting_vat_reclaim_countries (ISO-2 list); GET /:type already returns
  them parsed, so no GET change needed.
- New read-only GET /api/admin/vat-codes (adminAuth, NOT accounting-gated) so
  the invoice/quote editors can populate their VAT dropdown even when the
  accounting layer is off. Management CRUD stays under /admin/ledger.

backend/server.js

@@ -709,6 +709,9 @@ app.use('/api/admin/deals',      require('./src/routes/adminDeals'));
 app.use('/api/admin/tax-report', require('./src/routes/adminTaxReport'));
 app.use('/api/admin/expenses',   require('./src/routes/adminExpenses'));
 app.use('/api/admin/ledger',     require('./src/routes/adminLedger'));
+// Read-only VAT-code registry for the invoice/quote editors — un-gated by the
+// accounting flag (management stays under /ledger).
+app.use('/api/admin/vat-codes',  require('./src/routes/adminVatCodes'));
 app.use('/api/admin/system-health', require('./src/routes/adminSystemHealth'));
 app.use('/api/admin/dev',        require('./src/routes/adminDev'));
 app.use('/api/public/quotes',  require('./src/routes/publicQuotes'));