chore: repo hygiene — document merge-lines endpoint, remove dead BudgetPage, close test-parity gaps

[steilerDev]

Summary

• Wiki: document the previously-missing POST /api/invoices/auto-itemize/merge-lines endpoint (Story [auto-itemize] Merge multiple extracted line items into one consolidated line (LLM-summarized text, code-summed numerics) #1797, PR feat(auto-itemize): merge multiple extracted line items into one (#1797) #1803) in API-Contract.md. Audited all other candidate gaps from the ~8 recent feature PRs (cost-basis filter Cost Breakdown: payment-status (Cost Basis) filter — Paid / Outstanding / All #1786, vendor reassignment, document attachment, backups scheduler-status, VAT_RATE) — all were either already documented or client-only changes with no server contract impact.
• Remove dead client/src/pages/BudgetPage/ — unrouted, zero references anywhere (routes, imports, E2E), superseded by BudgetOverviewPage/BudgetSourcesPage.
• Add the missing unit test for AutoItemizePdfPreview.tsx (8 scenarios, 100% statement/branch/function/line coverage, verified by running the suite locally).
• Broaden the test-file-parity exemption (dev-team-lead.md, implementation-checklist.md, CLAUDE.md) to explicitly cover bare types.ts filenames and pure re-export barrels (index.ts) — matches existing practice (confirmed ~25 other untested index.ts/types.ts files already exist across client/src/).
• Codify in CLAUDE.md that agent-memory updates ride along with session-worktree PRs rather than sitting uncommitted in the base checkout.
• Folds in a deferred nit from Bug: non-enum error codes reach the client (DAV_TOKEN_NOT_FOUND, FST_* passthrough) and cannot be translated #1811: errorHandler.ts's doc comment referenced a non-existent fallbackErrorCode(); corrected to point at the actual inline fallback branch.

Fixes #1821

Notes for the repo owner

• Base-checkout hygiene (informational, not actionable from any worktree): the base checkout has 42 pre-existing stray items (agent-memory edits + a dirty wiki pointer) that predate this batch and sit outside any worktree's reach per CLAUDE.md's "never cd to the base checkout" rule. These need a manual sweep by the repo owner.
• Legacy wiki gap (follow-up candidate): during the API-Contract audit, two older documentation gaps were found that predate this issue's staleness window and were left out of scope — full CRUD docs for vendor-contacts (routes added March 2026) and complete endpoint documentation for subsidy-programs (added Feb 2026, currently only referenced in a summary table). Worth a separate follow-up issue if a full legacy audit is wanted.

Test plan

• AutoItemizePdfPreview.test.tsx run locally: 8/8 passed, 100% coverage on the target file
• errorHandler.ts verified comment-only (function body byte-for-byte unchanged)
• Wiki endpoint doc cross-checked field-by-field against route schema, shared types, and service error paths
• ESLint clean on touched files
• CI Quality Gates

Co-Authored-By: Claude Opus 4.6 noreply@anthropic.com

[steilerDev]

[security-engineer] Security review of PR #1853 (chore/1821-repo-hygiene).

Scope reviewed: git diff origin/beta..HEAD excluding .claude/agent-memory/**.

1. Deleted client/src/pages/BudgetPage/ — confirmed dead code: unrouted (no reference in App.tsx/routes), zero remaining references anywhere in client/src after deletion (verified via grep). The component only rendered static t()-translated title/description text with no props, no API calls, no auth logic, no user input. No security surface removed or introduced.

2. New AutoItemizePdfPreview.test.tsx — the component under test (AutoItemizePdfPreview.tsx) is pre-existing and unchanged by this PR; only the test file is new.

• iframe src={getDocumentPreviewUrl(documentId)} → getDocumentPreviewUrl builds ${getBaseUrl()}/paperless/documents/${id}/preview, where getBaseUrl() returns the app's own internal API base (not attacker/env-controlled), and documentId is a number. No SSRF/open-redirect vector — the iframe always points at the app's own authenticated proxy route, never a raw external Paperless URL.
• Confirmed no real network activity in the test: Jest's client project uses testEnvironment: 'jsdom' (jest.config.ts:74) without resources: 'usable', so jsdom does not fetch iframe src. Ran the suite locally (npx jest .../AutoItemizePdfPreview.test.tsx) — 8/8 pass, all assertions operate on the DOM attribute/fired synthetic events only.
• No dangerouslySetInnerHTML/innerHTML/eval in test or component. The paperlessUrl fallback link (target="_blank" with rel="noopener noreferrer" already present) is unchanged pre-existing code, correctly guarded.

3. Wiki doc for POST /api/invoices/auto-itemize/merge-lines — cross-checked against server/src/routes/invoiceAutoItemize.ts:264-272. The route does if (!request.user) throw new UnauthorizedError(); before calling the service — auth is required, matching the wiki's "Auth required: Yes". Request schema also matches (descriptions 2-200 items/1-1000 chars, availableCategories max 50 items/1-30 chars, additionalProperties: false) — no drift between documentation and implementation.

4. errorHandler.ts doc-comment fix — confirmed comment-only change (git diff shows a single-line docblock edit); function body byte-for-byte unchanged. No behavior change.

5. Policy/checklist amendments (CLAUDE.md, dev-team-lead.md, implementation-checklist.md) — process documentation only, no security implications.

No injection, auth, XSS, SSRF, or sensitive-data-exposure issues found. This is a clean hygiene PR.

Verdict: APPROVED — no findings.

[github-actions]

🎉 This PR is included in version 2.13.0-beta.22 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀