fix(analytics): make the displayed numbers mean what they say

Six metric-integrity defects from the UI/IA review, plus two found while
verifying the review's own claims against the code.

The reconciled-row exclusion existed only in queries.ts. Every analytics
route counted the superseded manual rows as spend — 48 rows, $4,474.79 of
double count, invisible precisely because the transaction list looked
right. It is now one fragment both sides import.

The spend-pace chart computed its own totals in the browser: gross
amounts, debits only, no personal share, no refunds, fees, interest or
itemised loan repayments. On live data it ended July at $4,747.31 under a
headline reading $3,597.10 — and its own baseline line was drawn from the
split-adjusted monthly totals, so the two series in one chart disagreed
with each other. Both now come from /api/analytics/daily, built from the
same fragments as the headline.

Fees aggregated every statement ever imported with no date filter, under
a heading with no period, so a lifetime figure read as a current one and
grew forever. Now bounded, labelled, and selectable.

Comparisons no longer measure a month in progress against complete ones:
the in-progress month is out of every baseline, and a selected current
month is compared through the same day.

Two the review did not catch:

- Every analytics window was a day early. toISOString() on a
  local-midnight Date converts backwards through UTC. Surfaced only once
  fees started reporting the range it had used.
- /monthly rounded per category, /daily per category-day, so the pace
  chart ended a few cents off the headline above it.

Shared currency needed amending rather than applying. Reading s.currency
would have labelled every order row AUD, since an order receipt has no
statement and carries its own currency — the opposite convention from a
foreign charge on an AUD statement, where amount IS AUD. NATIVE_CURRENCY's
COALESCE order keeps the two apart. Balances also now count rows whose AUD
value is genuinely unknown instead of netting a foreign figure against AUD
ones. Latent today: no foreign transaction is currently split.

Tag-filtered balance cards no longer claim "owes you". With a filter on,
payments are deliberately not subtracted, so the figure is a split total
and settling against it would record a payment for a debt that never was.

Split-coverage warnings deliberately omitted (user decision).

src/lib/analytics-sql.ts

@@ -1,7 +1,7 @@
 // Shared SQL fragments for analytics queries, so spend/income semantics stay
 // identical across routes.
 //
-// Two rules every analytics query must follow:
+// Three rules every analytics query must follow:
 //
 // 1. Join `statements` with LEFT JOIN and scope on COALESCE(t.owner_id, s.owner_id).
 //    An INNER JOIN silently drops every manual/CSV transaction (statement_id IS
@@ -11,6 +11,23 @@
 //    bank account and again as the underlying purchases on the card statement.
 //    Categorising the money movement as `transfers` and excluding it here is what
 //    stops the double count. Investments are a balance-sheet move, not spend.
+// 3. Apply EXCLUDE_RECONCILED_SOURCE to every row-level query. The transaction
+//    queries have always done this (`queries.ts`); analytics never did, which is
+//    the other half of the same double count.
+
+/**
+ * `YYYY-MM-DD` for a Date, read in local time.
+ *
+ * `toISOString().slice(0, 10)` is the obvious thing and it is wrong here: these
+ * are calendar boundaries built with `new Date(y, m, 1)`, which is local
+ * midnight. In any timezone east of UTC that converts to the *previous* day, so
+ * every window silently started and ended a day early — visible once the fees
+ * endpoint began reporting the range it had used ("2026-04-30" for a window
+ * meant to open on 1 May).
+ */
+export function toDateStr(d: Date): string {
+  return `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, "0")}-${String(d.getDate()).padStart(2, "0")}`;
+}
 
 /** Owner scoping that works for both statement-linked and manual transactions. */
 export const OWNER_SCOPE = `COALESCE(t.owner_id, s.owner_id)`;
@@ -18,6 +35,56 @@ export const OWNER_SCOPE = `COALESCE(t.owner_id, s.owner_id)`;
 /** Join clause to pair with OWNER_SCOPE. */
 export const STATEMENTS_JOIN = `LEFT JOIN statements s ON s.id = t.statement_id`;
 
+/**
+ * Drops the manual/CSV row that a statement line has superseded.
+ *
+ * Reconciliation keeps both rows: the manual one the user entered and the
+ * statement line it turned out to be. Only the statement line should count, or
+ * the same purchase is spent twice. `queries.ts` has always applied this; the
+ * analytics routes did not, so every reconciled row was double-counted in the
+ * category totals, movers, Pareto, and merchant rankings.
+ *
+ * Scoped to `statement_id IS NULL` deliberately: the *source* row is the manual
+ * one. A statement line pointing at something else is the survivor, not the
+ * duplicate.
+ *
+ * Order-receipt rows (`payment_method = 'credits'`) are unaffected — they are
+ * inserted with `reconciled_with_id` NULL and are held out of the reconcile
+ * queue by `needsCardMatch()`, so nothing ever sets it. If one is reconciled by
+ * hand against a card line, this is what stops it double-counting.
+ */
+export const EXCLUDE_RECONCILED_SOURCE = `NOT (t.statement_id IS NULL AND t.reconciled_with_id IS NOT NULL)`;
+
+/**
+ * The currency `t.amount` is actually denominated in.
+ *
+ * Two different conventions meet here and the COALESCE order is what keeps them
+ * apart:
+ *
+ *  - A statement row is denominated in its statement's currency. If that row is
+ *    an overseas purchase on an AUD statement, `amount` is still AUD and
+ *    `foreign_currency_code` merely records what was originally charged — so
+ *    `s.currency` must win.
+ *  - An order-receipt row has no statement. There, `amount` IS the native
+ *    figure and `foreign_currency_code` names it (order-ingestion.ts leaves
+ *    `amount_aud` NULL rather than asserting an FX rate it does not have).
+ *
+ * Reading `s.currency` alone labels every foreign order row as AUD.
+ * `s` must be the statements alias in scope.
+ */
+export const NATIVE_CURRENCY = `COALESCE(s.currency, t.foreign_currency_code, 'AUD')`;
+
+/**
+ * True when a row's AUD value is unknown: it is denominated in something other
+ * than AUD and carries no converted figure.
+ *
+ * Every settlement total uses `COALESCE(t.amount_aud, t.amount)`, which for such
+ * a row silently nets a foreign figure against AUD ones. Rather than drop the
+ * row (which changes a balance with no trace) or convert it (with no rate),
+ * count these and let the UI say the balance is incomplete.
+ */
+export const AMOUNT_UNCONVERTED = `(t.amount_aud IS NULL AND ${NATIVE_CURRENCY} <> 'AUD')`;
+
 /** Transaction types that represent money going out. */
 export const SPEND_TYPES = `('debit', 'fee', 'interest')`;