feat: implement two-step Freigabe→Zahlung workflow

Adds a payment step after document approval: PM_Freigabe approves
(Field 15 = "freigegeben"), then PM_Zahlung can mark as paid (Field 16).

- Backend: VIEW_ZAHLUNG permission mapped to PM_Zahlung OIDC group
- Backend: ZahlungModule with endpoints to list documents by filter
  (ausstehend/freigegeben/alle), set Field 16, fetch options from Paperless
- Backend: setZahlung() throws ForbiddenException if Field 15 ≠ "freigegeben"
- Frontend: /zahlung route with 3-way filter, two status columns (Freigabe + Zahlung)
- Frontend: "Zahlung verbuchen" button disabled with tooltip for non-approved docs
- Frontend: Zahlung menu item with EuroOutlined icon

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

paperless-frontend/src/auth/permissions.ts

@@ -6,6 +6,7 @@ export const Permission = {
   VIEW_SCANNER: 'VIEW_SCANNER',
   MANAGE_SETTINGS: 'MANAGE_SETTINGS',
   VIEW_FREIGABE: 'VIEW_FREIGABE',
+  VIEW_ZAHLUNG: 'VIEW_ZAHLUNG',
 } as const;
 
 export type Permission = typeof Permission[keyof typeof Permission];
@@ -26,6 +27,7 @@ export function mapGroupsToPermissions(groups: string[] | undefined | null): Per
     permissions.add(Permission.VIEW_SCANNER);
     permissions.add(Permission.MANAGE_SETTINGS);
     permissions.add(Permission.VIEW_FREIGABE);
+    permissions.add(Permission.VIEW_ZAHLUNG);
     return Array.from(permissions);
   }
 
@@ -44,6 +46,9 @@ export function mapGroupsToPermissions(groups: string[] | undefined | null): Per
   if (groups.includes('PM_Freigabe')) {
     permissions.add(Permission.VIEW_FREIGABE);
   }
+  if (groups.includes('PM_Zahlung')) {
+    permissions.add(Permission.VIEW_ZAHLUNG);
+  }
 
   return Array.from(permissions);
 }