fix(security+trips): auth/ownership on all API routes; trip analytics in AUD

Ten routes accepted requests with no getCurrentUser check (transactions/[id],
bulk, splits, tags-on-tx, splits/settle, statements/[id], tags, tags/[id],
merchants, participants/[id]/balance), and by-id routes did no ownership
check at all — any participant could read or modify another's data.

Adds canAccessTransactions() (owner via statement/direct, or split
participant), applies it to every transaction-scoped route, owner-scopes
statements/[id], and rescopes splits/settle in raw SQL so settlement only
touches splits the caller is party to.

Also: all trip analytics now sum COALESCE(amount_aud, amount) instead of raw
amount, matching every other analytics query — trip totals previously added
foreign-currency amounts to AUD ones unit-less.

And rules apply_split no longer delete+reinserts splits (which reset settled
flags on every run) — it upserts share_percent and removes only participants
no longer in the rule.

src/app/api/rules/apply/route.ts

@@ -151,11 +151,18 @@ export async function POST(req: NextRequest) {
 
       if (actions.apply_split?.length) {
         if (splitFrom && tx.transaction_date < splitFrom) continue;
-        await queryRaw(`DELETE FROM transaction_splits WHERE transaction_id = $1`, [tx.id]);
+        // Remove only participants no longer in the rule's split, and upsert the
+        // rest — a plain delete+reinsert would reset settled flags on every run.
+        await queryRaw(
+          `DELETE FROM transaction_splits WHERE transaction_id = $1 AND participant_id != ALL($2::int[])`,
+          [tx.id, actions.apply_split.map((s) => s.participant_id)]
+        );
         for (const s of actions.apply_split) {
           await queryRaw(
             `INSERT INTO transaction_splits (transaction_id, participant_id, share_percent)
-             VALUES ($1, $2, $3) ON CONFLICT DO NOTHING`,
+             VALUES ($1, $2, $3)
+             ON CONFLICT (transaction_id, participant_id)
+             DO UPDATE SET share_percent = EXCLUDED.share_percent`,
             [tx.id, s.participant_id, s.share_percent]
           );
         }