UI/settings api mcp (#524)

* feat(voucher): add create voucher and correct entry previews; update commit methods

* feat: add support for pending operations in API key scopes and OAuth client management

- Introduced new API key scopes for reading and approving pending operations.
- Updated the scope groups to include pending operations.
- Added new tools for listing and managing pending operations.
- Implemented OAuth client registration and revocation endpoints.
- Created a UI panel for managing OAuth clients, including registration and revocation.
- Added tests for pending operations tools and OAuth allowlist functionality.
- Implemented a database migration for OAuth client registrations with appropriate policies and constraints.

* feat: Implement OAuth client registration rate limiting and enhance security measures

- Added IP-based rate limiting to the OAuth client registration endpoint to prevent enumeration attacks.
- Introduced a service-role client for allowlist lookups, ensuring trust boundaries are maintained.
- Updated error responses to be uniform across different types of redirect URI validation failures.
- Enhanced tests to reflect changes in OAuth scope handling, ensuring fallback to read-only scopes when no scopes are provided.
- Improved handling of high-risk pending operations, requiring explicit confirmation for approvals.
- Added audit logging for OAuth client revocations and pending operation approvals/rejections to maintain a security audit trail.
- Refactored API key scope management to include default read-only scopes for OAuth-issued keys and added segregation-of-duties checks.

* feat: add recurring invoice scheduling functionality

- Implemented recurring invoice schedules with a new database schema.
- Created API routes for managing recurring invoices (GET and POST).
- Added cron job to automatically generate invoices based on schedules.
- Developed service functions for computing next run dates and executing schedules.
- Added tests for the new functionality, including validation and success cases.
- Introduced error handling for various scenarios in the invoice creation process.

* feat: refine VAT rate validation and enhance recurring invoice handling

types/index.ts

@@ -707,6 +707,57 @@ export interface InvoiceItem {
   created_at: string
 }
 
+// Recurring Invoice Schedule (template + monthly cadence)
+export type RecurringInvoiceScheduleStatus = 'active' | 'paused'
+
+export interface RecurringInvoiceSchedule {
+  id: string
+  company_id: string
+  user_id: string
+  customer_id: string
+
+  name: string
+
+  // Monthly cadence, day-of-month 1-31. Clamped to last day of month in
+  // shorter months (handled by computeNextRunDate).
+  day_of_month: number
+  payment_terms_days: number
+
+  currency: Currency
+  your_reference: string | null
+  our_reference: string | null
+  notes: string | null
+
+  auto_send: boolean
+  status: RecurringInvoiceScheduleStatus
+
+  next_run_date: string
+  last_run_at: string | null
+  last_invoice_id: string | null
+  last_run_warning: string | null
+  generated_count: number
+
+  created_at: string
+  updated_at: string
+
+  // Relations
+  customer?: Customer
+  items?: RecurringInvoiceScheduleItem[]
+}
+
+export interface RecurringInvoiceScheduleItem {
+  id: string
+  schedule_id: string
+  sort_order: number
+  description: string
+  quantity: number
+  unit: string
+  unit_price: number
+  // null = inherit customer's default VAT rate at spawn time
+  vat_rate: number | null
+  created_at: string
+}
+
 // Tax Rates (reference table)
 export interface TaxRate {
   id: string