fix(analytics): make the displayed numbers mean what they say

Six metric-integrity defects from the UI/IA review, plus two found while
verifying the review's own claims against the code.

The reconciled-row exclusion existed only in queries.ts. Every analytics
route counted the superseded manual rows as spend — 48 rows, $4,474.79 of
double count, invisible precisely because the transaction list looked
right. It is now one fragment both sides import.

The spend-pace chart computed its own totals in the browser: gross
amounts, debits only, no personal share, no refunds, fees, interest or
itemised loan repayments. On live data it ended July at $4,747.31 under a
headline reading $3,597.10 — and its own baseline line was drawn from the
split-adjusted monthly totals, so the two series in one chart disagreed
with each other. Both now come from /api/analytics/daily, built from the
same fragments as the headline.

Fees aggregated every statement ever imported with no date filter, under
a heading with no period, so a lifetime figure read as a current one and
grew forever. Now bounded, labelled, and selectable.

Comparisons no longer measure a month in progress against complete ones:
the in-progress month is out of every baseline, and a selected current
month is compared through the same day.

Two the review did not catch:

- Every analytics window was a day early. toISOString() on a
  local-midnight Date converts backwards through UTC. Surfaced only once
  fees started reporting the range it had used.
- /monthly rounded per category, /daily per category-day, so the pace
  chart ended a few cents off the headline above it.

Shared currency needed amending rather than applying. Reading s.currency
would have labelled every order row AUD, since an order receipt has no
statement and carries its own currency — the opposite convention from a
foreign charge on an AUD statement, where amount IS AUD. NATIVE_CURRENCY's
COALESCE order keeps the two apart. Balances also now count rows whose AUD
value is genuinely unknown instead of netting a foreign figure against AUD
ones. Latent today: no foreign transaction is currently split.

Tag-filtered balance cards no longer claim "owes you". With a filter on,
payments are deliberately not subtracted, so the figure is a split total
and settling against it would record a payment for a debt that never was.

Split-coverage warnings deliberately omitted (user decision).

src/app/api/analytics/fees/route.ts

@@ -1,12 +1,35 @@
 import { NextRequest, NextResponse } from "next/server";
 import { getCurrentUser } from "@/lib/auth";
 import { queryRaw } from "@/lib/db";
-import { OWNER_SCOPE, STATEMENTS_JOIN, mySplitOf } from "@/lib/analytics-sql";
+import { OWNER_SCOPE, STATEMENTS_JOIN, EXCLUDE_RECONCILED_SOURCE, mySplitOf, toDateStr } from "@/lib/analytics-sql";
 
+/**
+ * Fees and interest over an explicit window.
+ *
+ * This used to aggregate every statement ever imported with no date filter, and
+ * the UI printed the result with no period label — so a lifetime-to-date total
+ * read as a current-period one, and grew forever. `months=0` asks for all time
+ * deliberately, which is a different claim from asking for it by accident.
+ */
 export async function GET(req: NextRequest) {
   const user = await getCurrentUser(req);
   if (!user) return NextResponse.json({ error: "Unauthorized" }, { status: 403 });
 
+  const { searchParams } = new URL(req.url);
+  const monthsParam = Number(searchParams.get("months") ?? "12");
+  const months = Number.isFinite(monthsParam) ? Math.min(Math.max(monthsParam, 0), 120) : 12;
+  const allTime = months === 0;
+
+  const now = new Date();
+  const from = new Date(now.getFullYear(), now.getMonth() - months + 1, 1);
+  const fromStr = toDateStr(from);
+  const toStr = toDateStr(new Date(now.getFullYear(), now.getMonth() + 1, 1));
+
+  // A statement is dated by the period it covers, not by when it was imported.
+  const stmtWindow = allTime ? "" : `AND billing_end_date >= $2 AND billing_end_date < $3`;
+  const txnWindow = allTime ? "" : `AND t.transaction_date >= $2 AND t.transaction_date < $3`;
+  const windowParams = allTime ? [] : [fromStr, toStr];
+
   // Statement-level fees and interest (aggregated by Gemini from the PDF)
   const stmtRows = await queryRaw<{
     bank_name: string;
@@ -19,10 +42,11 @@ export async function GET(req: NextRequest) {
       SUM(COALESCE(interest_charged, 0))::numeric(12,2) AS interest
     FROM statements
     WHERE owner_id = $1
+    ${stmtWindow}
     GROUP BY bank_name
     HAVING SUM(COALESCE(fees_charged, 0)) + SUM(COALESCE(interest_charged, 0)) > 0
     ORDER BY (SUM(COALESCE(fees_charged, 0)) + SUM(COALESCE(interest_charged, 0))) DESC`,
-    [user.id]
+    [user.id, ...windowParams]
   );
 
   // Transaction-level fee and interest line items (split-adjusted)
@@ -49,8 +73,10 @@ export async function GET(req: NextRequest) {
     ${STATEMENTS_JOIN}
     WHERE ${OWNER_SCOPE} = $1
       AND t.transaction_type IN ('fee', 'interest')
+      AND ${EXCLUDE_RECONCILED_SOURCE}
+      ${txnWindow}
     ORDER BY t.transaction_date DESC`,
-    [user.id]
+    [user.id, ...windowParams]
   );
 
   const by_bank = stmtRows.map((r) => ({
@@ -69,5 +95,13 @@ export async function GET(req: NextRequest) {
   const total_fees = by_bank.reduce((s, r) => s + r.fees, 0);
   const total_interest = by_bank.reduce((s, r) => s + r.interest, 0);
 
-  return NextResponse.json({ by_bank, transactions, total_fees, total_interest });
+  return NextResponse.json({
+    by_bank,
+    transactions,
+    total_fees,
+    total_interest,
+    // The period is part of the answer — the client must be able to say what
+    // window these totals cover rather than implying "now".
+    period: { months, from: allTime ? null : fromStr, to: allTime ? null : toStr, all_time: allTime },
+  });
 }