feat: confirm consequential payment and journal creates

[ryanduguid]

Summary

• make payments create and manual-journals create fail closed unless the caller supplies the confirmation returned by a prior dry run
• bind that deterministic SHA-256 confirmation to the selected Xero tenant ID, operation and canonical payload
• keep dry runs non-mutating even when --confirm is also supplied
• show only a bounded, redacted payload summary and the selected organisation tenant ID
• add command-level fake-client tests proving zero create SDK calls for missing, wrong and dry-run confirmation, and exactly one call for a matching value

Migration and limits

This intentionally changes both create commands. Run the unchanged command with --dry-run, review its organisation tenant ID and redacted summary, then rerun it with --confirm and the printed value.

The confirmation is deterministic, reusable and non-expiring. It is not a secret, one-time token or cross-process replay guarantee. A tenant, operation or payload change invalidates it.

Relationship

Depends on #39. This branch includes #39 as its first commit so the confirmation gate is validated together with strict calendar parsing and DRAFT, finite, exact-cent balanced manual-journal validation. Review commit 20b06d5 for this PR's confirmation-specific change.

Validation

• npx vitest run test/lib/mutation-confirmation.test.ts test/commands/consequential-create-confirmation.test.ts (8 passed)
• npm test (10 files, 143 passed)
• npm run build (passed)
• git diff --check (passed)

The command tests inject fake Xero clients. No Xero API or external financial service was called. The passing command-test run emits an @oclif/core optional dev-plugin discovery warning for @oclif/plugin-plugins; exit status remains zero.