feat: report payments, fetch received invoices and export them for the accountant

[btouchard]

Three gaps after deposit: gofact could not report a payment, did not know when a supplier invoice arrived, and offered nothing for the accountant, since the SuperPDP API has no way to grant read access.

Payments (fr:212). report_payment (MCP, destructive, confirm=true) and gofact paid post the lifecycle event. Without date or amount, SuperPDP takes the invoice total. A dated or partial payment must carry one MEN block per VAT rate with its percentage (BR-FR-CDV-14, rejected by the sandbox otherwise); gofact splits the amount pro rata of each rate's gross total, read from the sidecar. The payment goes to the journal and shows as encaissee_le in list_invoices.

Received invoices. SuperPDP has no webhook; the documented way is GET /invoices?direction=in&starting_after_id=N, ids being strictly increasing. gofact sync and list_received_invoices (refresh=true) walk every page, download each invoice as a readable Factur-X PDF (even when received as UBL/CII) into recues/YYYY-MM/, and keep the cursor in pdp-sync.json, advanced only once the file is written. gofact sync raises a desktop notification (notify-send, osascript, PowerShell toast).

Accounting export. gofact export / export_invoices write <dest>/<org>/<YYYY-MM>/ with emises/, recues/ and recapitulatif.csv (;, decimal comma, BOM for Excel). Unchanged PDFs are not copied again. gofact sync refreshes the current and previous month when GOFACT_EXPORT_DIR is set.

Scheduling. gofact schedule installs a systemd user timer, a LaunchAgent or a Windows scheduled task; it only prints the plan without -yes, like gofact install.

Tests: an MCP test against a mocked SuperPDP covers payment refusal before deposit, total/partial/dated payments, two-page reception with no refetch, and the export CSV; unit tests for the VAT split, file names and the two amount shapes of the API.

Sandbox (Burger Queen account): three fr:212 accepted and visible in the lifecycle; listing and PDF download decoded against the real API, which revealed that the seller block needs expand[]=en_invoice.seller (fixed); export checked. Not covered: receiving a real invoice (this sandbox account has none, it needs another sandbox company's credentials), Windows toast and applying schedule -yes.

Local CI replay: act -j cross green; mkdocs build --strict green under act -j build (only the Pages upload fails, no runtime token under act); test cannot start Chrome under act, so go vet ./... and go test ./... were replayed by hand with a real Chrome — green, nothing skipped.

Independent of #26; both touch docs/pdp.md in different sections.