feat(arap): settle documents with discounts and a fee (P4b S6)

One payment had to name one document and could take no discount or
processor fee, so paying several invoices from one deposit meant several
entries and the fee had nowhere to go. This adds the kernel's exact
settlement arithmetic (applications total, net deposit), a Ledger::settle
that posts one entry for a customer's or vendor's documents, and the gross
method and gross fee A-8/A-4 chose.

- kernel::settle: sum(cash)+sum(discounts)=applications, sum(cash)-fee=
  deposit, None on overflow or a negative deposit. Kani settle_is_exact
  plus the Decimal bridge.
- Ledger::settle / settlement_lines: one party and one kind per
  settlement, one application per document, each cash+discount within
  payment_room; a discount within the terms (discount_max and
  discount_by) needs no reason, a larger or later one does; a bill with
  an asset line is refused with D-49's remedy; a fee is a customer
  payment's only and posts gross.
- Rows are payment lines in application order, then discount lines, the
  fee line and the cash line, so a journaled event's line indices are
  stable; replay tags exactly the line an event names and leaves an
  unmatched line unattached (never refuses).
- receive_payment_with and pay_bill_with become one-application calls.
- Roles: sales_allowances (4100), purchase_discounts (6995) and
  payment_processing_fees (6060), constants used on demand but not added
  to control_accounts() (existing charts may use those codes for other
  things).
- Lean: settle posts through Step.document, so settle_posts_a_document_step
  and settle_unattached, no new constructor; both in Audit.lean.
- Core tests: bill_on_terms_with_discount, late_discount_needs_a_reason,
  discount_on_an_asset_bill_is_refused_with_the_remedy,
  a_fee_posts_gross_to_receivables_and_net_to_the_bank,
  a_settlement_names_its_lines_and_refuses_a_document_twice, and
  equipment_bill_payment_is_investing_cash in the cash-flow suite.
- Bookspec B-42 is stated, with its id BS-arap-6; the catalogue and index
  now record it as CONVENTION.

just check and just prove green.

docs/verification.md

@@ -504,6 +504,25 @@ come from the kernel:
       No Lean model: these are two arithmetic laws, not a new `Ledger`
       command (S4.1 adds fields to the existing document commands).
 
+### Settlements (P4b S6)
+
+34. **A settlement is exact.** The applications' total is Σ cash + Σ
+    discounts and the deposit is Σ cash − fee, with exact arithmetic; a
+    fee above the cash, a negative amount, or arrays of different lengths
+    is refused (None), never wrapped or rounded. The core's posting is a
+    document step: every control line a settlement posts carries its
+    document, so `Documents.control_agrees` covers it and no new `Step`
+    constructor is needed.
+    - Kani `settle_is_exact` (at i32, fixed arrays of three applications,
+      a nonzero discount and a nonzero fee covered) · bridge
+      `settle_agrees` · tests `bill_on_terms_with_discount`,
+      `late_discount_needs_a_reason`,
+      `discount_on_an_asset_bill_is_refused_with_the_remedy`,
+      `a_fee_posts_gross_to_receivables_and_net_to_the_bank`,
+      `a_settlement_names_its_lines_and_refuses_a_document_twice` · Lean
+      `Documents.settle_posts_a_document_step`,
+      `Documents.settle_unattached`.
+
 ## What the proofs found
 
 The engine already had 190+ tests, property tests, mutation testing,
@@ -701,7 +720,9 @@ headline theorems) and `just prove-slow` 467 s (8 harnesses, the slowest
 
 P4b S4.1's two harnesses were measured on 2026-10-26 (a busy machine);
 the rest are the 2026-10-22 run. `discount_max_is_bounded`'s 163 s is
-Kani's verification time (it runs in `prove-slow`).
+Kani's verification time (it runs in `prove-slow`). P4b S6 adds
+`settle_is_exact` to `prove` and two Lean theorems to the audit
+(`Documents.settle_posts_a_document_step`, `Documents.settle_unattached`).
 
 Every harness, the law it proves, the recipe that runs it, and its time
 in that quiet run (`prove`: each harness's verification time; `prove-slow`:
@@ -766,4 +787,5 @@ each harness's whole run, its compile of about 50 s included):
 | `unrecovered_cost_laws` | 32 | prove | 0 |
 | `discount_max_is_bounded` | 33 | prove-slow | 163 |
 | `line_amount_is_exact` | 33 | prove | 6 |
+| `settle_is_exact` | 34 | prove | 1 |
 | `kani_symbolic_copy_canary` | (the checker: "Trusting the checker") | prove | 3 |