fix(expense): authenticated receipt download + correct delete confirm

The receipt <a href target=_blank> was an unauthenticated browser navigation
that the API's [Authorize] rejects with 401. Replace with a HttpClient blob
download (downloadReceipt) so the auth interceptor attaches the JWT, opened
via an object URL. Also fix the delete button: confirm() must run inside the
component method (matching givings-page), not as a template expression where
confirm is not a component member.

APP/src/app/features/expense/pages/my-reimbursements-page/my-reimbursements-page.component.ts

@@ -42,11 +42,21 @@ export class MyReimbursementsPageComponent implements OnInit {
   }
 
   submit(row: ExpenseListItemDto): void { this.api.submit(row.id).subscribe(() => this.load()); }
-  remove(row: ExpenseListItemDto): void { this.api.delete(row.id).subscribe(() => this.load()); }
+  remove(row: ExpenseListItemDto): void {
+    if (!confirm('Delete this reimbursement?')) return;
+    this.api.delete(row.id).subscribe(() => this.load());
+  }
+
+  openReceipt(id: number): void {
+    this.api.downloadReceipt(id).subscribe(blob => {
+      const url = URL.createObjectURL(blob);
+      window.open(url, '_blank');
+      setTimeout(() => URL.revokeObjectURL(url), 60_000);
+    });
+  }
 
   canEdit(row: ExpenseListItemDto): boolean { return row.status === 'Draft'; }
   statusClass(status: string): string {
     return ({ Draft: 'badge-draft', PendingApproval: 'badge-pending', Approved: 'badge-approved', Paid: 'badge-paid', Rejected: 'badge-rejected' } as Record<string, string>)[status] ?? '';
   }
-  receiptUrl(id: number): string { return this.api.receiptUrl(id); }
 }