Return Fudo expense, category and provider fields; add stock and supplier tools - #1517

What

Fixes the Fudo connector reads and adds the tools a customer needs to load purchase invoices.

Why

A Cloud customer reported that fudo_list_expenses, fudo_get_expense and fudo_list_expense_categories return only ids. I checked the official spec (https://api.fu.do/v1alpha1/openapi.yml) and the customer's account with read-only calls. Fudo leaves out attributes unless the request names them in fields[...]. This hits expenses and expense categories, which come back with ids only, and providers, which come back with the name only. The connector now asks for the fields itself.

The customer also asked for expense items that update stock. The API cannot do that: POST and PATCH /expenses accept no items, and there is no endpoint for them. Items can only be read. The instructions now say so, and fudo_update_ingredient lets the model book a purchase into stock.

Changes

• Reads: sparse fieldsets on expenses (incl. expense items with ingredient, product and unit), expense categories and providers.
• New read tools: fudo_get_ingredient, fudo_get_provider, fudo_list_roles (to explain a 403).
• New filters: expense status, payment expense_id (sale payments and expense payments are mixed), ingredient ids.
• New writes, installed off: fudo_update_expense, fudo_create_expense_payment, fudo_create_expense_category, fudo_create_provider, fudo_update_provider, fudo_update_ingredient.
• Instructions: fields, expense items, stock and units (there is no units endpoint; they come with include=unit), duplicate check.

Cloud and self-hosted behave the same: this only changes the adapter JSON.

Tests

• node scripts/validate-adapters.mjs --warn (root): no Fudo warnings.
• node scripts/regenerate-catalog.mjs (root): 710 adapters, no catalog.ts diff.
• node scripts/adapter-count.mjs --check (root): OK.
• npx jest src/adapters/intl/fudo.live.spec.ts --maxWorkers=2 (packages/backend): 8 passed, including 2 new static tests.
• Live, read-only, with the customer's credentials: every changed read tool, as the engine builds it, answered 200 with the attributes. Writes were not run.
• src/adapters/catalog.spec.ts could not run locally. The shared node_modules has a Prisma client generated from another branch, so the suite fails to compile in oauth2-token.service.ts, which this PR does not touch. CI runs it.