fix(cashier): fix GL account search SQL bug, running balance, and add CASHIER role permissions

- Fix searchParam SQL syntax: parameterized LIKE with %value% instead of literal %?%
- Fix organizationRunningBalance: correlated subquery for latest journal entry (ORDER BY id DESC LIMIT 1)
- Migration 0317: grant READ_GLACCOUNT, READ_LOAN, READ_SHAREACCOUNT to CASHIER role

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

fineract-accounting/src/main/java/org/apache/fineract/accounting/glaccount/service/GLAccountReadPlatformServiceImpl.java

@@ -74,7 +74,10 @@ public class GLAccountReadPlatformServiceImpl implements GLAccountReadPlatformSe
             }
             sb.append("from acc_gl_account gl left join m_code_value cv on tag_id=cv.id ");
             if (this.associationParametersData.isRunningBalanceRequired()) {
-                sb.append("left outer Join acc_gl_journal_entry gl_j on gl_j.account_id = gl.id");
+                sb.append("left outer join acc_gl_journal_entry gl_j on gl_j.id = (")
+                  .append("select id from acc_gl_journal_entry ")
+                  .append("where account_id = gl.id ")
+                  .append("order by id desc limit 1) ");
             }
             return sb.toString();
         }
@@ -149,10 +152,10 @@ public class GLAccountReadPlatformServiceImpl implements GLAccountReadPlatformSe
                 if (firstWhereConditionAdded) {
                     sql += SQL_AND;
                 }
-                sql += " ( name like %?% or gl_code like %?% )";
+                sql += " ( name like ? or gl_code like ? )";
-                parameterArray[arrayPos] = searchParam;
+                parameterArray[arrayPos] = "%" + searchParam + "%";
                 arrayPos = arrayPos + 1;
-                parameterArray[arrayPos] = searchParam;
+                parameterArray[arrayPos] = "%" + searchParam + "%";
                 arrayPos = arrayPos + 1;
                 firstWhereConditionAdded = true;
             }

fineract-provider/src/main/resources/db/changelog/tenant/changelog-tenant.xml

@@ -344,4 +344,5 @@
     <include file="parts/0314_cashier_staff_unique_constraint.xml" relativeToChangelogFile="true"/>
     <include file="parts/0315_grant_cashier_transaction_entry_permissions.xml" relativeToChangelogFile="true"/>
     <include file="parts/0316_create_clerk_role_and_permissions.xml" relativeToChangelogFile="true"/>
+    <include file="parts/0317_grant_cashier_gl_loan_share_read_permissions.xml" relativeToChangelogFile="true"/>
 </databaseChangeLog>

fineract-provider/src/main/resources/db/changelog/tenant/parts/0317_grant_cashier_gl_loan_share_read_permissions.xml

@@ -0,0 +1,49 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements. See the NOTICE file
+    for licensing details.
+-->
+<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
+                   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+                   xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog
+                   http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.1.xsd">
+
+    <!--
+        Grant READ permissions to CASHIER role for new account types added
+        in the Cashier Transaction Entry screen:
+          - READ_GLACCOUNT  : GL account lookup and balance (AC. TP. = GL)
+          - READ_LOAN       : Loan account lookup          (AC. TP. = LA)
+          - READ_SHAREACCOUNT : Share account lookup       (AC. TP. = SHR)
+    -->
+    <changeSet id="0317_grant_cashier_gl_loan_share_read_permissions" author="fineract">
+        <sql>
+            INSERT INTO m_role_permission (role_id, permission_id)
+            SELECT r.id, p.id
+            FROM m_role r
+            JOIN m_permission p ON p.code IN (
+                'READ_GLACCOUNT',
+                'READ_LOAN',
+                'READ_SHAREACCOUNT'
+            )
+            WHERE r.name = 'CASHIER'
+              AND NOT EXISTS (
+                SELECT 1 FROM m_role_permission rp
+                WHERE rp.role_id = r.id AND rp.permission_id = p.id
+              );
+        </sql>
+        <rollback>
+            DELETE FROM m_role_permission
+            WHERE role_id = (SELECT id FROM m_role WHERE name = 'CASHIER')
+              AND permission_id IN (
+                SELECT id FROM m_permission
+                WHERE code IN (
+                    'READ_GLACCOUNT',
+                    'READ_LOAN',
+                    'READ_SHAREACCOUNT'
+                )
+              );
+        </rollback>
+    </changeSet>
+
+</databaseChangeLog>