Add per-event finance, event team permissions and public door sales state.

Event finance
- Finance tab on the event page: P&L summary with a revenue-to-result
  waterfall, costs and other income in one ledger, and the partner split
  with payouts. Lifecycle stepper (Selling, Adding costs, Ready to close,
  Finalized) with what is left to do; closing the books goes through a
  checklist dialog that freezes the numbers.
- Expense modal shows only the fields each calculation type needs, a live
  preview with the event's real counts, and a category suggested from the
  description. Date inputs follow the UI language.
- Global Finance page: profit per event with outliers clipped and labelled,
  and a "Ready to close" list of past events whose books are still open.
- Calculation service (integer PYG, basis points) with pinned regression
  scenarios; PYG formatting centralised in lib/money with locale-aware
  separators.

Event team permissions
- Per-event members with role presets and requireEventPermission; the
  header stat "Confirmed" is relabelled "Not checked in yet", which is
  what it counts.

Public sales state
- One sales state (online, door, sold out, ended, external, cancelled) for
  the event page, listings and JSON-LD, with the door price and tenders
  shown only while people can still pay at the door.

Frontend unit tests run with vitest (npm test in frontend/).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

backend/src/index.ts

@@ -13,6 +13,8 @@ import { getClientIp } from './lib/rateLimit.js';
 import eventsRoutes from './routes/events.js';
 import ticketsRoutes from './routes/tickets.js';
 import doorRoutes from './routes/door.js';
+import eventFinanceRoutes from './routes/eventFinance.js';
+import financeRoutes from './routes/finance.js';
 import usersRoutes from './routes/users.js';
 import contactsRoutes from './routes/contacts.js';
 import paymentsRoutes from './routes/payments.js';
@@ -2025,6 +2027,8 @@ app.route('/api/auth-ext', authExtRoutes);
 // Door check-in screen endpoints live under /api/events/:eventId/door-*.
 // Mounted first so the generic /:id routes below can never shadow them.
 app.route('/api/events', doorRoutes);
+// Per-event finance, partners and team access (/api/events/:id/finance, /expenses, /members, ...)
+app.route('/api/events', eventFinanceRoutes);
 app.route('/api/events', eventsRoutes);
 app.route('/api/tickets', ticketsRoutes);
 app.route('/api/users', usersRoutes);
@@ -2040,6 +2044,7 @@ app.route('/api/site-settings', siteSettingsRoutes);
 app.route('/api/legal-pages', legalPagesRoutes);
 app.route('/api/legal-settings', legalSettingsRoutes);
 app.route('/api/faq', faqRoutes);
+app.route('/api/finance', financeRoutes);
 
 // 404 handler
 app.notFound((c) => {