Parties, attachment links, statements, reconciliations (store), TIN vault crate

Parties: one directory for vendors, contractors, customers, employees,
members, platforms, agencies, banks, landlords (ledger-core parties.rs).
W-9/W-4 facts without the number (last four only; any nine-digit run in a
party field is refused, Treas. Reg. 301.6109-4). Vendor and customer
records link to parties on replay; core tags every bill, invoice, payment,
and reversal with its counterparty. Journal events party.*,
entry.party_set; payroll lines name the employee party.

MCP: books.add_party, update_party, set_party_roles, set_w9, set_w4,
parties, party, set_entry_party; draft_entry party; run_payroll employee;
show party. Viewer: Parties directory and party pages, search, journal
text, W-9 attention, demo data.

One definition of a party's money (ledger_core::parties::activity) for
MCP and viewer. 1099 amounts count payments from cash and financing
accounts (a member paying for the company counts; a card doesn't; a
prepayment counts when made): vendor_1099_report_with, B-19.

Store: attachment links to any subject, statements, reconciliations
(schema v11), with replay and projection. ledger-vault: encrypted TIN and
W-9 records (ChaCha20-Poly1305, key file outside the books).

Spec-blind tests for parties (core, store, MCP, viewer) and attachments.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX

crates/ledger-config/src/lib.rs

@@ -112,6 +112,9 @@ pub struct BooksSettings {
     /// ("FL" for "FL-0001"). Unset: [`BooksSettings::asset_tag_prefix`]
     /// derives it from the company name.
     pub asset_tag_prefix: Option<String>,
+    /// `[vault] key_file`: the TIN vault's key file. Unset: the vault's
+    /// default (`~/.config/wanderbooks/vault.key`).
+    pub vault_key_file: Option<std::path::PathBuf>,
 }
 
 impl BooksSettings {
@@ -168,6 +171,13 @@ struct BooksToml {
     company: CompanyToml,
     #[serde(default)]
     books: BooksSection,
+    #[serde(default)]
+    vault: VaultSection,
+}
+
+#[derive(Default, Deserialize)]
+struct VaultSection {
+    key_file: Option<String>,
 }
 
 #[derive(Default, Deserialize)]
@@ -497,6 +507,16 @@ pub fn parse(text: &str) -> Result<BooksSettings, String> {
         cash_accounts: codes("cash_accounts", raw.books.cash_accounts)?,
         financing_accounts: codes("financing_accounts", raw.books.financing_accounts)?,
         investing_accounts: codes("investing_accounts", raw.books.investing_accounts)?,
+        vault_key_file: match raw.vault.key_file {
+            Some(p) if p.trim().is_empty() => {
+                return Err("[vault] key_file is empty".into());
+            }
+            Some(p) => Some(std::path::PathBuf::from(match p.strip_prefix("~/") {
+                Some(rest) => format!("{}/{rest}", std::env::var("HOME").unwrap_or_default()),
+                None => p,
+            })),
+            None => None,
+        },
         asset_tag_prefix: match raw.books.asset_tag_prefix {
             Some(p)
                 if !p.is_empty()