Parties, attachment links, statements, reconciliations (store), TIN vault crate

Parties: one directory for vendors, contractors, customers, employees,
members, platforms, agencies, banks, landlords (ledger-core parties.rs).
W-9/W-4 facts without the number (last four only; any nine-digit run in a
party field is refused, Treas. Reg. 301.6109-4). Vendor and customer
records link to parties on replay; core tags every bill, invoice, payment,
and reversal with its counterparty. Journal events party.*,
entry.party_set; payroll lines name the employee party.

MCP: books.add_party, update_party, set_party_roles, set_w9, set_w4,
parties, party, set_entry_party; draft_entry party; run_payroll employee;
show party. Viewer: Parties directory and party pages, search, journal
text, W-9 attention, demo data.

One definition of a party's money (ledger_core::parties::activity) for
MCP and viewer. 1099 amounts count payments from cash and financing
accounts (a member paying for the company counts; a card doesn't; a
prepayment counts when made): vendor_1099_report_with, B-19.

Store: attachment links to any subject, statements, reconciliations
(schema v11), with replay and projection. ledger-vault: encrypted TIN and
W-9 records (ChaCha20-Poly1305, key file outside the books).

Spec-blind tests for parties (core, store, MCP, viewer) and attachments.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX

crates/ledger-cli/src/main.rs

@@ -322,6 +322,13 @@ receipt_threshold = "25.00"
 # by books.roles. Until assigned, each uses its default code (1200, 2000,
 # 4000, 6999, 3999, 6100, 6110, 2110-2150).
 
+[vault]
+# The TIN vault (full taxpayer identification numbers and W-9s, encrypted,
+# in vault/ beside the books, which git ignores) is opened with this key
+# file, kept OUTSIDE the books. Keep a copy in your password manager:
+# without it the vault can't be read. Unset: ~/.config/wanderbooks/vault.key
+# key_file = "~/.config/wanderbooks/vault.key"
+
 [viewer]
 # When a session starts and the viewer isn't open (`just gui-status`), the
 # agent: "ask" offers to open it, "always" opens it (`just gui`), "never"
@@ -332,6 +339,8 @@ open_at_start = "ask"
 const GITIGNORE: &str = r#"# The SQLite projection is disposable — it rebuilds from journal.jsonl.
 books-data/wanderbooks.db
 books-data/wanderbooks.db-*
+# The TIN vault: encrypted, but never in git (it must be purgeable).
+vault/
 # Copies of a database that disagreed with the journal, kept when it is
 # rebuilt; disposable like the database itself.
 books-data/wanderbooks.mismatch.*