List entity-scoped candidate documents for a transaction

The mirror of /documents/{id}/match-candidates (#2013). Search and ranking run on the server; the attach-document picker previously filtered a ten-row client page, so a company holding hundreds of unmatched receipts could be shown none. Candidates are filtered on the DISPLAYED document type, which is re-derived from metadata and can differ from the stored type column. A candidate whose attachedTransactionId is non-null is already attached to another transaction: attaching it here replaces that link rather than adding one, and for a bill that reverses its payment posting.