fix: harden Payment Insights lifecycle handling

[Raafet57]

Summary

• Hardens the merged Payment Insights Lite /insights feature after a fresh bug/refactor review.
• Removes a dead post-expansion matching loop and makes thread-label fallback explicit in lifecycle correlation.
• Prevents empty pacs.002 / pacs.004 documents with no MsgId from synthesizing phantom transaction identifiers while preserving MsgId-only linkability.
• Adds shared humanized thread-key labels for UI and Markdown reports.
• Fixes sample-bundle retry UX and delays object URL cleanup after report downloads.
• Adds regression coverage for return/status linking, multi-entry camt.054, empty status/return placeholders, humanized labels, no raw XML report markers, and broken sample-bundle retry.

Privacy / product boundary

• Browser-only; no backend, uploads, telemetry, analytics, remote logging, or browser persistence introduced.
• Positioning remains: local lifecycle insight over files the user provides — not live payment tracking.
• No live BIC lookup, VOP, SEPA reachability, settlement monitoring, account ownership, certified validation claim, or raw XML report export introduced.

Review gates

• Claude plan-only review completed.
• Codex plan review initially requested amendments; amended plan approved.
• Claude implementation completed within approved scope.
• Codex implementation review: APPROVED.

Verification

• pnpm test -- src/lib/insights/analyze.test.ts src/pages/InsightsPage.test.tsx — passed, 27 files / 200 tests.
• pnpm typecheck — passed.
• pnpm format — completed; diff limited to intended files plus new format.ts.
• pnpm verify — passed: lint, format check, typecheck, unit tests, privacy audit, deterministic data checks, build.
• pnpm test:e2e — passed, 18/18.
• npx -y @google/design.md lint DESIGN.md — 0 errors; existing unused-token warnings only.
• git diff --check — passed.
• Static added-line scans for hardcoded secrets, shell/eval/deserialization, browser persistence/telemetry/external URLs — clean.

Non-actions

• No deployment, release, tag, or public announcement.