security: harden AI extraction, CSV export, and the migration script

[BastiOfBerlin]

security: harden AI extraction, CSV export, and the migration script

Part of the series in #553. Five independent fixes, none of which changes
behaviour for a correctly-configured instance. Grouped into one PR because they
are all small and all fall out of the same audit; happy to split any of them out
if you'd rather review them separately.

Nothing here is being publicly disclosed anywhere; if you'd prefer to take any
of it privately instead, say so and I'll close this and re-send.

1. AI extraction was reachable with the feature flags off

extractExpenseInformationFromImage and extractCategoryFromTitle are server
actions, so each has its own callable endpoint. ENABLE_RECEIPT_EXTRACT and
ENABLE_CATEGORY_EXTRACT only ever hid the buttons that call them.

An instance that deliberately leaves the AI features off — because the operator
does not want to pay for them, or has no key configured — still had them
callable by anyone who can reach the app, spending the operator's OpenAI credit.
Both actions now check getRuntimeFeatureFlags() before doing any work.

2. Receipt extraction forwarded any caller-supplied URL to OpenAI

The image URL is a plain string parameter of the action. Since the action is
directly callable (see above), an arbitrary URL could be passed and OpenAI would
fetch it: an SSRF primitive using someone else's egress, plus unmetered API
spend on images the app never uploaded.

New isAllowedUploadUrl restricts extraction to http(s) URLs on the app's own
configured S3 host. It derives that host exactly the way next.config.mjs
derives the image remotePatterns — custom S3_UPLOAD_ENDPOINT if set,
otherwise the bucket.s3.region.amazonaws.com form — so the trusted-host set
stays consistent between the two. With no S3 configured the allow-list is empty
and nothing passes, which is the right answer: without uploads there are no
receipts to extract.

Unit-tested, including suffix look-alikes (minio.example.com.evil.com),
non-http(s) schemes, port insensitivity, and the unconfigured case.

3. The receipt action could return NaN

The model is asked for a plain number but nothing guarantees it obliges;
Number() on anything else yields NaN, which flowed into the expense form. It
now reports null, which the dialog already renders as "unknown" — the existing
truthiness check on receiptInfo.amount handles both, so this is a
tightening rather than a behaviour change.

4. CSV formula injection (CWE-1236)

Expense titles, category names and participant names are user-controlled and
were written to the export verbatim. A cell beginning with =, +, -, @,
tab or CR is executed as a formula by Excel, LibreOffice and Google Sheets when
the file is opened.

So a group member can title an expense =HYPERLINK(...) or a WEBSERVICE call
and have it execute in another member's spreadsheet — the export is the delivery
mechanism, and the person who opens it is not the person who wrote the text.
Such cells are now prefixed with a single quote, the standard neutralisation.

5. The CSV route created its own PrismaClient

Every other data path uses the @/lib/prisma singleton; this route constructed a
second client at module scope, opening a second connection pool. On a
long-running container that is a slow leak against the database's connection
limit. Now uses the singleton, matching the JSON export route right next to it.

Two smaller items in the same spirit

• src/scripts/migrate.ts disabled TLS verification process-wide. It set
  NODE_TLS_REJECT_UNAUTHORIZED='0' at module scope, which turns off
  certificate validation for every outbound TLS connection the process makes,
  not just the legacy database one it was meant for. The script now connects
  with validated TLS; a self-signed legacy database can supply its CA through a
  new OLD_POSTGRES_CA_CERT env var. (This is the one-off v1→v2 import script,
  so the blast radius is small, but it is also the script most likely to be run
  with production credentials in the environment.)
• ci.yml had no permissions: block, so it ran with the repository's
  default token scopes. The checks only read the repository. cd.yml already
  declares per-job permissions, so this just brings CI in line.

Verification

npm ci --ignore-scripts, npx prisma generate, check-types, lint,
check-formatting all clean against current main (lint: 16 warnings, all
pre-existing). uploaded-image-url.test.ts adds 14 cases.

Not included

The regex-injection fix in add-group-by-url-button.tsx was part of the same
audit, but it already went upstream with #558 — it was needed there to keep the
QR scanner's relative-URL support from accepting any host.