Fix government share double-posting; restrict Close Sales Order to Managers

[github-actions]

Backport of #46 to version-15.

---

• Fixes a deferred-revenue accounting bug where completing a Plot Contract
  double-posted (and in some cases miscalculated) the government share to
  Government Payable, on top of the incremental per-payment postings already
  made as the customer pays.
• Restricts the "Close Sales Order" action — button and whitelisted server
  method — to users with the LandMS Sales Manager role, both in the UI
  and at the API level.

Details

Government share double-posting & miscalculation (plot_contract.py, payment_sync.py)

Two compounding bugs in the deferred-revenue model:

1. Double-posting: Plot Contract._post_completion_entries re-credited
   the full government_fee_withheld to Government Payable at contract
   completion — on top of the incremental credits payment_sync already
   posts as each payment comes in. Every completed contract's government
   share was effectively doubled.
2. Wrong calculation base: the incremental postings used the Payment
   Entry's full paid_amount (which can include unallocated extra cash
   bundled into the same transaction) instead of the allocated_amount
   actually applied to the plot-sale invoice/order — and didn't sum
   allocated_amount across multiple reference rows when Frappe split one
   payment's allocation across several rows to the same invoice.

Fix: completion now recognizes only net_revenue (government share is
posted solely incrementally), and the incremental postings sum
allocated_amount across every relevant reference row as the tax base.

Verified end-to-end with two fresh full-payment-cycle tests through the
real TCB IPN flow (including a split-allocation edge case), and corrected
the 3 genuinely affected completed contracts in live data for
LACQ-2026-0002 via audit-safe reversing Journal Entries
(ACC-JV-2026-17252/53/54, totaling 10,699,700.29 — verified diff = 0.00
against government_fee_withheld for all three).

Close Sales Order — Manager-only restriction (sales_order.js, sales_order_hooks.py)

The custom "Close Sales Order" action had no role check — any user with
Sales Order access could trigger its cascade (forfeiture JE, invoice/
contract cleanup, TCB control-number decline, application and plot release)
directly from the UI, or by calling the whitelisted method via the API.

• Client: frappe.user.has_role('LandMS Sales Manager') hides the custom
  button from non-Managers (the standard Close/Hold buttons remain hidden
  for everyone, funneling all users through the safe flow).
• Server: frappe.only_for("LandMS Sales Manager") enforces the same
  restriction in close_sales_order, so it can't be bypassed by calling
  the method directly.