feat(1099): add Payee1099Service recipient CRUD with TIN protection

Implement IPayee1099Service and Payee1099Service: list/get/create/update/
soft-delete and RevealTin. TIN is encrypted via ITinProtector on write;
TinLast4 is the only clear-text fragment stored. Null Tin on update
preserves the existing ciphertext. Four xUnit tests cover encrypt-on-create,
null-tin-keeps-ciphertext, list-masks-to-last4, and soft-delete hides from list.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

API/ROLAC.API/Services/IPayee1099Service.cs

@@ -0,0 +1,13 @@
+using ROLAC.API.DTOs.Payee;
+namespace ROLAC.API.Services;
+
+public interface IPayee1099Service
+{
+    Task<List<Payee1099ListItemDto>> GetAllAsync(bool includeInactive);
+    Task<Payee1099Dto?> GetByIdAsync(int id);
+    Task<int> CreateAsync(SavePayee1099Request r);
+    Task UpdateAsync(int id, SavePayee1099Request r);
+    Task DeleteAsync(int id);
+    /// <summary>Full decrypted TIN. Caller must be authorized (gated at controller).</summary>
+    Task<string?> RevealTinAsync(int id);
+}