feat: GL-account filter for ledger export

[sunnykid-02]

Close: #482

Summary
Implemented GET /api/v1/ledger/export?gl_account=&cursor=&limit= with HMAC-signed opaque cursor pagination and computed totals row.
Files changed
File Action Purpose
src/lib/pagination.ts Modified Added signCursor() / verifyCursor() HMAC-SHA256 helpers
src/services/ledgerExportService.ts Created LedgerExportService.byGlAccount(), InMemoryLedgerRepository, types, computeTotals() with BigInt arithmetic
src/routes/ledgerExport.ts Created Route handler with input validation
src/routes/ledgerExport.test.ts Created 10 contract tests covering all edge cases
src/db/repositories/ledgerEntryRepository.ts Created PG-backed PgLedgerEntryRepository for production use
src/index.ts Modified Mounted /ledger/export at apiRouter level
src/config/env.ts Modified Added CURSOR_SIGNING_SECRET and WEBHOOK_QUEUE_MAX_DEPTH
docs/ledger-export-gl-filter.md Created Full documentation
Key design decisions

• Cursor format: base64url(JSON({id,gl,t})) . base64url(HMAC-SHA256) — opaque, scoped to gl_account, tamper-proof
• Totals row: computed using BigInt arithmetic on decimal strings — exact match to sum of returned entries
• Repository interface: abstract LedgerExportRepository for DI — in-memory for tests, PgLedgerEntryRepository for production
• hasMore: determined by fetching limit + 1 and discarding the extra; no offset-position query needed
  Test results
  Tests: 10 passed, 10 total
  Coverage on new files: ledgerExport.ts 95.45%, ledgerExportService.ts 100% lines.

[drips-wave]

@sunnykid-02 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[sunnykid-02]

Done. Close: #635