Business Manager

h2. Live Wise API pull — bank account as source of truth

Replace the manual CSV statement import as the primary path with a live pull from the Wise API, so the bank account becomes the source of truth for income/expense and reconciliation.

*Note on process:* this Feature was designed via the architect-design flow (see design doc) rather than the Submitted->Spec automation, and is created at "In development" to track work already built and heading to dev.

h3. Scope (spans both repos)
* *API* (businessmanager-api): Wise HTTP adapter behind the existing @BankAdapter@ port (no SDK), SCA signing (RSA PKCS#1 v1.5 + SHA-256, single-use OTT, bounded 429/5xx backoff), @UpsertPreservingRecon@ (Wise owns the bank fact, app keeps reconciliation state), @SyncFromBank@ (fetch->upsert->audit in one transaction), @POST /api/v1/bank/sync@ (OWNER-gated, tenant-scoped), migration *0015* (wise_profile_id / wise_balance_id), and @server wise discover@ CLI.
* *Web* (businessmanager-web): "Sync from Wise" button on the Reconcile screen, data-seam wiring (@syncBank@), onboarding fields (WISE_SCA_PRIVATE_KEY + profile/balance ids).

h3. Design
docs/architecture/04-wise-live-pull.md (api repo).

h3. State / risks
* Built, code-reviewed (ship-with-fixes, no blockers, fixes applied), gates green: @go build/vet/make test@ (incl. testcontainers) and @npm run build@.
* *NOT yet verified against the real Wise API* — only a mocked Wise server. Sandbox validation (api.wise-sandbox.com) pending.
* DB migration *0015* runs against each environment on deploy.
* Owner setup before live use: register the SCA public key in Wise, paste WISE_API_TOKEN + WISE_SCA_PRIVATE_KEY, run @server wise discover@ for the profile id.

h3. Branches
* businessmanager-api: @feature/<this-id>-wise-live-pull@ -> PR to @dev@
* businessmanager-web: @feature/<this-id>-wise-live-pull@ -> PR to @dev@