add-server-actionlisted

# Add Server Action / Mutation Every mutation touching money or permission-scoped data must follow this shape. ## Steps 1. **Write a failing test first** before writing the handler body. Cover: permission-denied, self-service-scope-denied (if applicable), success-with-audit-log-assertion, and domain immutability if applicable. See `testing-conventions` skill for auth-faking patterns. 2. **Validate input** with a shared schema — client and server import the same one. 3. **Resolve the caller** via shared session helper — don't reimplement per action. 4. **Check authorization before any DB access**: - Required permission key present - If self-service scoped, verify target record belongs to caller - Fail closed before touching data 5. **Mutate via server-only privileged data-access layer** — never client credentials. 6. **Write audit log** for money/permission-touching actions — not optional. 7. **Respect immutability** — never update finalized records in place; create adjustment records. 8. Return typed result; let UI re-fetch rather than optimistic-update sensitive data. ## Checklist - [ ] Paired test file was red before implementation turned it green - [ ] Validated input - [ ] Permission + scope checks - [ ] Privileged data access only - [ ] Audit log written (if applicable) - [ ] No hard delete, no in-place edit of frozen records - [ ] Consider running `domain-rule-auditor` before merge ## Pattern ```typescript export async function approveExpense(ra