feat(api): expose fiscal configuration

[Sam-24-dev]

Summary

• Add GET /api/v1/fiscal-configuration/ for the active workspace's current fiscal configuration.
• Enforce fresh active membership, tenant isolation, strict public projection, Decimal-string tax rates, and no-store JSON responses.

Changes

File	Change
backend/fiscal/services.py	Adds a distinct not-configured domain outcome.
backend/api/fiscal_views.py	Adds the read-only fiscal configuration endpoint.
backend/api/urls.py	Registers the endpoint.
backend/api/tests.py	Covers access, tenant isolation, projection, Decimal serialization, and HTTP contract.

Testing

• python manage.py check
• python manage.py makemigrations --check --dry-run
• Focused API tests: 74/74
• Full Django suite: 333/333
• git diff --check

Contributor checklist

• Linked an approved issue
• Added exactly one type:* label
• Conventional commit format
• No Co-Authored-By trailers

Closes #145

[Copilot]

🟢 Approval recommended

The endpoint behavior matches the stated contract (auth, isolation, projection, no-store, Decimal string rates) and is backed by targeted tests covering the key acceptance criteria.

Pull request overview

This PR adds a read-only API endpoint to expose the current fiscal configuration for the caller’s active workspace, aligning with the existing active-workspace session model and enforcing tenant isolation and role-based access via the fiscal service layer.

Changes:

• Introduces a distinct domain outcome for “authorized workspace but no fiscal configuration” (FiscalConfigurationNotConfigured).
• Adds GET /api/v1/fiscal-configuration/ with strict field projection, query-param rejection, and Cache-Control: no-store.
• Adds API tests covering auth/session requirements, tenant isolation, role enforcement, 404 contract, Decimal-as-string serialization, and 405 JSON responses.

File summaries

File	Description
backend/fiscal/services.py	Splits “missing configuration” into an explicit not-configured outcome separate from access denial.
backend/api/fiscal_views.py	Implements the read-only fiscal configuration endpoint with strict projection and error mapping.
backend/api/urls.py	Registers the new fiscal configuration route under the API v1 namespace.
backend/api/tests.py	Adds endpoint-focused tests for access control, isolation, serialization, and HTTP contract behavior.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.