Split views_api into a domain package; unshadow /accounts/hierarchy
Hygiene sweep: dead code, role-assignment race, cached user lookup, stale files
Auth exact-matching, review-race guards, centralized account-name validation
Fava client hardening: write-lock coverage, shared HTTP client, JSON assertions
Settlement balance guards, per-currency netting, Decimal rates