feat: implement two-step Freigabe→Zahlung workflow

Adds a payment step after document approval: PM_Freigabe approves
(Field 15 = "freigegeben"), then PM_Zahlung can mark as paid (Field 16).

- Backend: VIEW_ZAHLUNG permission mapped to PM_Zahlung OIDC group
- Backend: ZahlungModule with endpoints to list documents by filter
  (ausstehend/freigegeben/alle), set Field 16, fetch options from Paperless
- Backend: setZahlung() throws ForbiddenException if Field 15 ≠ "freigegeben"
- Frontend: /zahlung route with 3-way filter, two status columns (Freigabe + Zahlung)
- Frontend: "Zahlung verbuchen" button disabled with tooltip for non-approved docs
- Frontend: Zahlung menu item with EuroOutlined icon

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

paperless-backend/src/auth/permissions.enum.ts

@@ -6,6 +6,7 @@ export const Permission = {
   VIEW_SCANNER: 'VIEW_SCANNER',
   MANAGE_SETTINGS: 'MANAGE_SETTINGS',
   VIEW_FREIGABE: 'VIEW_FREIGABE',
+  VIEW_ZAHLUNG: 'VIEW_ZAHLUNG',
 } as const;
 
 export type Permission = (typeof Permission)[keyof typeof Permission];
@@ -27,6 +28,7 @@ export function mapGroupsToPermissions(
     permissions.add(Permission.VIEW_SCANNER);
     permissions.add(Permission.MANAGE_SETTINGS);
     permissions.add(Permission.VIEW_FREIGABE);
+    permissions.add(Permission.VIEW_ZAHLUNG);
     return Array.from(permissions);
   }
 
@@ -36,6 +38,7 @@ export function mapGroupsToPermissions(
   if (groups.includes('PM_Posteingang')) permissions.add(Permission.VIEW_INBOX);
   if (groups.includes('PM_Scanner')) permissions.add(Permission.VIEW_SCANNER);
   if (groups.includes('PM_Freigabe')) permissions.add(Permission.VIEW_FREIGABE);
+  if (groups.includes('PM_Zahlung')) permissions.add(Permission.VIEW_ZAHLUNG);
 
   return Array.from(permissions);
 }