fix: tenant-config fixes, cashier/share/savings UI bugs, and menu-access hardcoding

- Add Balance Sheet report and disabled-features accounting config
- Point menu-access tenant header and env.js/environment.ts tenant identifier
  at env config instead of hardcoded 'default'/'lincpay' literals
- Surface the real backend error (not a generic "no reference id") when an
  OTP send fails in contact-otp-block
- Fix branch-day "₹null" display bug (null vs undefined) and add a guard
  blocking a branch's first-ever day open before cash denomination migration
- Dynamically size the denomination count input and block re-opening an
  already-open business day from Migrate Cash Denomination
- Lock the denomination-managed cash GL row in Migrate Opening Balances
  (read-only, with a link back to Migrate Cash Denomination)
- Remove duplicate Cancel/Submit action bars on the Share Product and
  Savings Account creation preview steps; align Previous into the same row
- Hide "Apply Collection" on a share account once its advance collection
  is already settled (further purchases go through Apply Additional Shares)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src/app/accounting/disabled-features.ts

@@ -0,0 +1,43 @@
+/**
+ * Copyright since 2025 Mifos Initiative
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ */
+
+import { inject } from '@angular/core';
+import { Router, CanActivateFn } from '@angular/router';
+
+/**
+ * Accounting features switched off for this installation.
+ *
+ * Nothing is deleted — the components, routes and services all stay in place, and flipping a flag
+ * back to `false` brings the feature back with its tile and its route. The matching API block lives
+ * in DisabledFeatureApiFilter on the backend, so a hidden feature cannot be reached by calling the
+ * endpoint directly either.
+ */
+export const DISABLED_ACCOUNTING_FEATURES = {
+  createJournalEntries: true,
+  frequentPostings: true,
+  closingEntries: true,
+  accruals: true,
+  provisioningEntries: true,
+  accountingRules: true
+};
+
+/**
+ * Blocks a route belonging to a disabled feature, for anyone who reaches it by typing the URL
+ * rather than through a tile. `data.feature` names the flag to check.
+ */
+export const accountingFeatureEnabledGuard: CanActivateFn = (route) => {
+  const router = inject(Router);
+  const feature = route.data?.['feature'] as keyof typeof DISABLED_ACCOUNTING_FEATURES | undefined;
+
+  if (!feature || !DISABLED_ACCOUNTING_FEATURES[feature]) {
+    return true;
+  }
+
+  router.navigate(['/accounting'], { replaceUrl: true });
+  return false;
+};