feat: add rent/delinquency tracking and document links

[hypnoticdata777]

Two gaps stood out as the next-highest-value additions for a beginner PM company on top of the lease tracking already shipped: nobody could see who owed money, and there was nowhere to point at the actual lease PDF, W9, or COI once you knew it existed.

Rent collection:

• Tenants gain a balanceDue field and a "Payment" quick action on their card that records an amount, reduces the balance, stamps lastPaymentDate, and logs it to the audit trail.
• A past-due chip appears on any tenant with a positive balance (escalating to danger once they owe a full month's rent), reusing the same chip styling as the lease-status feature.
• Launch Plan risk queue surfaces a "Delinquency" item with the tenant count and total dollars outstanding across the portfolio.

Document links:

• Properties, tenants, and vendors can each carry one external document link (lease PDF, COI, W9, deed) — just a URL field, no file upload or storage backend, consistent with the zero-backend philosophy.
• isSafeUrl() only accepts http(s):// links and is enforced twice: once on save (client-side form validation) and again at render time, since portfolio records can also arrive via JSON import or Team Sync, neither of which goes through the form's validation. Verified live that a javascript: URL is rejected outright rather than ever reaching an .

Added getDelinquencyStatus() and isSafeUrl() as tested pure functions in utils.js/utils.cjs. Demo company, "Add Starter Example", and the templates.cjs mirror all carry sample balances/document links so the features are visible without manual entry.

Verified end-to-end in-browser: doc links render and are clickable, a malicious javascript: URL is rejected with a clear alert instead of being saved, the payment flow correctly reduces an outstanding balance and updates the chip, the Launch Plan risk queue picks up delinquent tenants with the right dollar total, and the demo company shows both lease and delinquency chips plus document links out of the box. Full test suite (73 passing) and production build both clean, zero console errors during the live run.

[hypnoticdata777]

js/utils.js:124 (getDelinquencyStatus)

js/utils.js:132 (isSafeUrl)

js/views/portfolio.js:485-500 (recordTenantPayment)

js/views/portfolio.js:497 (recordTenantPayment)

js/views/portfolio.js:501 (audit log entry)