Match a bank transaction to a bill and reflect its pay state

DARK — 404s unless company_subledger_flags.ar_ap_items_enabled is true. Creates the applied document_match through the production bill-payment apply path (idempotent, reconciliation-lock safe — never touches a reconciled transaction/JE), then reflects the AP pay state via the existing fail-closed recompute. A covering match settles the bill to paid; a partial one leaves it partially_paid. Re-POST of the same pair converges to the same state rather than a conflict.