feat: financial data retention & aggregation system

Add CleanupExpiredFinancialRecords to enforce HMRC + Limitation Act
compliance (7-year retention, 1-year post-anonymization buffer).

- financial_aggregates table: monthly totals by payment method/type (no PII)
- CleanupExpiredFinancialRecords(): aggregates expired payments/refunds,
  deletes granular records, idempotent via ON CONFLICT DO UPDATE
- Wired into GET /api/availability alongside existing cleanup functions
- 8 tests: 7yr expiry, 1yr buffer, 9yr override, aggregation totals,
  idempotency, active user protection, both-thresholds elapsed, refunds
- testdb.go: financial_aggregates in drop-order and truncate lists
- README + Technical Manual updated

backend/testutils/testdb/testdb.go

@@ -104,6 +104,7 @@ func Migrate(t *testing.T, pool *pgxpool.Pool) {
 			"user_saved_cards",
 			"square_deposits",
 			"affiliate_payouts",
+			"financial_aggregates",
 			"bookings",
 			"user_patch_tests",
 			"patch_tests",
@@ -211,6 +212,7 @@ func TruncateTables(t *testing.T, pool *pgxpool.Pool) {
         "user_saved_cards",
         "square_deposits",
         "affiliate_payouts",
+        "financial_aggregates",
         "bookings",
         "booking_edit_requests",
         "user_patch_tests",