feat(billing): receipt capture — outstanding workflow, batch by check, reconciliation

Implements docs/RECEIPT_CAPTURE_SPEC.md §1, the legacy "Editor"
replacement, on top of the single-movement capture from plan step 6.
No new abilities: batching and resolving are both capturing.

- outstanding (legacy NOPAGO): capture flag, ?outstanding= filter, and
  POST /billing/:id/resolve-outstanding (gated ledger:create, not
  ledger:void — resolving completes a capture rather than reversing
  one). Outstanding rows are excluded from every balance aggregate,
  matching the legacy SALDOS ULTIMO 0 query's HAVING NOPAGO = 0, but
  still count in the movement browser's filtered totals.
- POST /billing/batch: many customers' receipts against one check, in
  one $transaction. Deliberately not a persisted batch entity —
  checkNumber is already a column and grouping by it answers every
  legacy by-check query.
- GET /billing/by-check + a cheque-count report, replacing REPORTE
  CHEQUE COUNT / REPORTE POR CHEQUE / EDITA CHEQUE ALF|COUNT|NUM. Print,
  PDF, CSV and XLSX come free from the existing /reportes/:slug machinery.
- Web: /estado-cuenta/lote (the Editor screen, with live reconciliation
  against the physical check amount), an "Estado de pago" filter, a
  "sin fondos" row tag and a Resolver dialog, plus a top-level "Captura"
  nav entry.

Integration seam for the OCR auto-capture module (spec §2), which is
required to post through createBatch rather than writing Transaction
rows itself: items[i] maps to lines[i] so postedTransactionId can be
zipped back on; opts.refs[i] stamps captureRef with a duplicate-post
guard that a voided row deliberately does not block; opts.source is
service-level only, so an HTTP client cannot label hand-keyed rows as
machine-captured. captureSource/captureRef are nullable so the 40,136
migrated rows stay NULL rather than being mislabelled.

Fixes two pre-existing bugs found while building this:

- statement() filtered legacySourceTable with `notIn`, which compiles to
  SQL NOT IN — and `NULL NOT IN (...)` is NULL, so every app-captured
  movement was invisible on the customer statement (438 rows in the
  movement browser vs 392 on the statement) while showing everywhere
  else. This would have made the whole capture feature look broken.
- The balances count query omitted the void filter its own page query
  applied, so the total disagreed with the rows.

Nav highlighting now resolves by longest match; the previous
first-startsWith logic lit up both the parent and any nested entry.

Verified end-to-end against the dev DB, API and browser; all test rows
removed afterwards. Also corrects RESUME.md, which documented the dev
ports as :3001/:3000 — they are :4501/:4500, from the env files.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/web/src/components/AppShell.tsx

@@ -20,6 +20,10 @@ const NAV: { href: string; label: string; ability?: Ability; exact?: boolean }[]
   { href: "/servicios", label: "Propiedades" },
   { href: "/polizas", label: "Pólizas" },
   { href: "/estado-cuenta", label: "Estado de cuenta" },
+  // Daily data-entry screen (the legacy "Editor"), so it earns a top-level
+  // entry rather than living one click inside the Movimientos tab. Hidden from
+  // VIEWER, who can't capture anyway — the page itself also refuses.
+  { href: "/estado-cuenta/lote", label: "Captura", ability: "ledger:create" },
   { href: "/banco", label: "Chequera" },
   { href: "/reportes", label: "Reportes" },
   { href: "/catalogos", label: "Catálogos", ability: "lookup:manage" },
@@ -27,12 +31,33 @@ const NAV: { href: string; label: string; ability?: Ability; exact?: boolean }[]
   { href: "/operaciones", label: "Operaciones", ability: "db:manage" },
 ];
 
+/**
+ * Which nav entry is highlighted for a path. Longest matching href wins, so a
+ * nested route (`/estado-cuenta/lote`) highlights its own entry instead of also
+ * lighting up its parent (`/estado-cuenta`) — while `/estado-cuenta/<id>`, which
+ * has no entry of its own, still correctly highlights the parent.
+ */
+function activeHref(pathname: string | null): string | null {
+  if (!pathname) return null;
+  let best: string | null = null;
+  for (const item of NAV) {
+    const match = item.exact
+      ? pathname === item.href
+      : pathname === item.href || pathname.startsWith(`${item.href}/`);
+    if (match && (best === null || item.href.length > best.length)) {
+      best = item.href;
+    }
+  }
+  return best;
+}
+
 export function AppShell({ children }: { children: ReactNode }) {
   const router = useRouter();
   const pathname = usePathname();
   const [user, setUser] = useState<AuthUser | null>(null);
   const [checking, setChecking] = useState(true);
   const [loggingOut, setLoggingOut] = useState(false);
+  const current = activeHref(pathname);
 
   useEffect(() => {
     let alive = true;
@@ -94,9 +119,7 @@ export function AppShell({ children }: { children: ReactNode }) {
           <nav className="appbar-nav" aria-label="Principal">
             {NAV.filter((item) => !item.ability || can(user, item.ability)).map(
               (item) => {
-                const active = item.exact
-                  ? pathname === item.href
-                  : pathname?.startsWith(item.href) ?? false;
+                const active = current === item.href;
                 return (
                   <Link
                     key={item.href}