Fix pursue_* sibling tools to use documented Lexware endpoints

[lazyants]

Summary

Mirrors the pursue_invoice fix from #33 across the 4 sibling tools that also hit the broken POST /<resource>/{id}/actions/pursue path (HTTP 404 on the live Lexware API):

• pursue_credit_note → POST /credit-notes?precedingSalesVoucherId={id}[&finalize=true]
• pursue_delivery_note → POST /delivery-notes?precedingSalesVoucherId={id}
• pursue_order_confirmation → POST /order-confirmations?precedingSalesVoucherId={id}
• pursue_dunning → POST /dunnings?precedingSalesVoucherId={id}

Also removes pursue_quotation — quotations are the start of the Lexware sales-voucher chain and have no documented preceding-voucher endpoint. Prior implementation returned HTTP 404 unconditionally.

Total tool count: 65 → 64, entry-sales 34 → 33.

Breaking change

Input schema for the 4 rewired tools changes from { id, version } to { precedingSalesVoucherId, body } (plus optional finalize boolean on pursue_credit_note only — the one endpoint Lexware documents [&finalize=true] on). Callers using the old shape will fail input validation loudly.

Security-review fix

Flipped destructiveHint: true on pursue_credit_note — finalize=true immediately reduces the preceding invoice's open amount, an irreversible financial side effect on a sibling resource.

Test plan

• npm run build clean (tsc)
• npm test — 163/163 tests pass (27 files)
• npm run lint clean (eslint flat)
• code-simplifier: no changes needed
• codex:rescue: clean after docs/CHANGELOG fixes
• /security-review: clean after destructiveHint flip + README header fix
• Smoke counts updated: full 65→64, entry-sales 34→33
• README + CHANGELOG updated (Removed + BREAKING Changed entries)

[lazy-ants-reviewer]

No blocking findings.

I verified the changed pursue_* tools against the public Lexware endpoint documentation and checked that the removed quotation pursue tool matches the absence of a documented quotation pursue endpoint. Local verification passed with npm test, npm run build, and npm run lint.

[lazy-ants-reviewer]

No blocking findings.

I re-reviewed the synchronized head. The only change since my previous review is the lockfile returning to the version already on main, so it is not part of the PR diff. I rechecked the Lexware documented pursue endpoints and reran npm ci, npm test, npm run build, and npm run lint; all passed.