feat(finance): add Form 990 report DTOs and permission module

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

API/ROLAC.API/Authorization/Modules.cs

@@ -16,6 +16,7 @@ public static class Modules
     public const string OfferingSessions  = "OfferingSessions";
     public const string Ministries        = "Ministries";
     public const string FinanceDashboard  = "FinanceDashboard";
+    public const string Form990Report     = "Form990Report";
     public const string MonthlyStatements = "MonthlyStatements";
     public const string ChurchProfile     = "ChurchProfile";
     public const string Disbursements     = "Disbursements";
@@ -37,6 +38,7 @@ public static class Modules
         OfferingSessions,
         Ministries,
         FinanceDashboard,
+        Form990Report,
         MonthlyStatements,
         ChurchProfile,
         Disbursements,

API/ROLAC.API/DTOs/Finance/Form990ReportDtos.cs

@@ -0,0 +1,25 @@
+namespace ROLAC.API.DTOs.Finance;
+
+/// <summary>One Part IX row: a 990 line split across the three functional columns.</summary>
+public class FunctionalExpenseRowDto
+{
+    public string  LineCode = "";
+    public string  Name_en  = "";
+    public string? Name_zh;
+    public decimal Program;
+    public decimal ManagementGeneral;
+    public decimal Fundraising;
+    public decimal Total;
+}
+
+/// <summary>The full Part IX Statement of Functional Expenses for a date range.</summary>
+public class FunctionalExpenseStatementDto
+{
+    public List<FunctionalExpenseRowDto> Rows { get; set; } = [];
+    public decimal ProgramTotal           { get; set; }
+    public decimal ManagementGeneralTotal { get; set; }
+    public decimal FundraisingTotal       { get; set; }
+    public decimal GrandTotal             { get; set; }
+    /// <summary>Expenses with no explicit 990 mapping (counted under line 24). Prompts mapping cleanup.</summary>
+    public int     UnmappedExpenseCount   { get; set; }
+}

API/ROLAC.API/Data/DbSeeder.cs

@@ -158,6 +158,7 @@ public static class DbSeeder
         ("finance", Modules.MonthlyStatements, true, true,  false, true),
         ("finance", Modules.ChurchProfile,     true, true,  false, false),
         ("finance", Modules.Disbursements,     true, true,  true,  true),
+        ("finance", Modules.Form990Report,     true, false, false, false),
 
         // Logs — read-only. System logs are technical (pastor only); audit logs have
         // governance value, so finance and board members can read them too.
@@ -165,6 +166,8 @@ public static class DbSeeder
         ("pastor",       Modules.AuditLogs,    true, false, false, false),
         ("finance",      Modules.AuditLogs,    true, false, false, false),
         ("board_member", Modules.AuditLogs,    true, false, false, false),
+        ("pastor",       Modules.Form990Report, true, false, false, false),
+        ("board_member", Modules.Form990Report, true, false, false, false),
 
         // Ministries — secretary maintains the list; coworker_chair edits; ministry
         // leaders and pastor read.