feat(admin): an all-accounts ledger section with filters and totals

There was no way to see the money as a whole: the ledger was only ever rendered
inside one account's card, so "what came in last month" meant exporting the
entire CSV and reading it elsewhere.

/_gm/ledger lists every operation, newest first, filtered by date range
(defaulting to the last 30 days), by wallet, by rail, by kind and by account.
Wallet and rail are deliberately separate axes because they answer different
questions — "what happened on VK" matches the funded segment or the benefit
origin, while "what came through YooKassa" matches the settling provider, and a
chip spend has no rail at all, so it drops out of that filter by construction.

Above the table sit the totals for everything the filter matches, not merely the
page on screen, which is the point of showing them. Money is listed per currency
because the rails settle in roubles, Votes and Stars and one sum across them
would mean nothing. Row amounts come from the operation snapshot, since the
ledger's own columns count chips rather than money.

Paging, the CSV export and a refund's way back are all built from the same
encoded filter, so none of them can quietly show a different slice than the
screen. The export moves here from the user card and gains the filter along with
money columns; it is capped, because an append-only ledger grows forever and an
unbounded export would eventually time out.

The refund action moves onto the funded rows here — an operator can now find a
payment by filter without knowing whose it is first — and returns to the same
filtered view. The destination travels with the form but is only honoured when
it is a console path, so a crafted form cannot turn it into an open redirect.

The user card keeps the account's standing rather than its history: balances,
benefits, the risk flag and a lifetime summary (money paid and refunded per
currency, chips credited and spent), plus a link into the ledger scoped to that
account. Operations are rendered in one place, with filters and paging, instead
of two.

Tests: the filter axes, paging that neither repeats nor drops a row, totals that
describe the range rather than the page, money recovered from a snapshot and
absent on a spend, and the console page, the export and the card hand-off. The
existing finance-panel test now asserts the summary and that the card no longer
re-renders the rows.

backend/internal/adminconsole/views.go

@@ -207,16 +207,26 @@ type UserDetailView struct {
 }
 
 // FinanceView is the account's payments picture on the user card: chip balances per funding
-// segment, benefits per origin, the recorded refund risk, and the append-only ledger history
-// (newest first). Present is false when the payments domain is unwired.
+// segment, benefits per origin, the recorded refund risk, and a short lifetime summary. The
+// operations themselves live in the ledger section, which this links to pre-filtered to the
+// account — the card answers "where does this account stand", not "what happened when".
+// Present is false when the payments domain is unwired.
 type FinanceView struct {
 	Present  bool
 	Segments []SegmentRow
 	Benefits []BenefitRow
 	// Abuse is the refund abuse flag; Loss is the unrecoverable chip loss from floor-0 refunds.
-	Abuse  bool
-	Loss   int
-	Ledger []LedgerRow
+	Abuse bool
+	Loss  int
+	// Paid is the money the account has spent, per currency, already formatted; Refunded is what
+	// came back. ChipsBought counts every chip ever credited (purchases, rewarded views, grants) and
+	// ChipsSpent every chip spent on a value.
+	Paid        []string
+	Refunded    []string
+	ChipsBought int
+	ChipsSpent  int
+	// LedgerQuery is the ledger-section query string that shows this account's operations.
+	LedgerQuery template.URL
 }
 
 // SegmentRow is one funding segment's chip balance.
@@ -234,22 +244,6 @@ type BenefitRow struct {
 	Forever  bool
 }
 
-// LedgerRow is one append-only ledger entry: its kind, funding source / benefit origin, signed chip
-// delta, the product / order / provider / direct-rail shop it references (empty when none), the raw
-// snapshot JSON and the pre-formatted time.
-type LedgerRow struct {
-	Kind       string
-	Source     string
-	Origin     string
-	ChipsDelta int
-	Product    string
-	Order      string
-	Provider   string
-	Shop       string
-	Snapshot   string
-	At         string
-}
-
 // RelationRow is one cross-linked account in the user card's blocks / blocked-by / friends
 // lists: the other account's id (the link target), its display name, and the pre-formatted date.
 type RelationRow struct {
@@ -764,3 +758,53 @@ type GrantProductOption struct {
 	Summary  string
 	Archived bool
 }
+
+// LedgerView is the all-accounts financial ledger: one page of operations, the totals for
+// everything the current filter matches (not merely the page), and the filter state itself so the
+// form renders back what the operator asked for. FilterQuery is those filters URL-encoded, carried
+// into the pager, the CSV export and the refund's return link so every one of them stays on the
+// same slice of the ledger (see MessagesView.FilterQuery).
+type LedgerView struct {
+	Rows        []LedgerRow
+	Pager       Pager
+	Totals      LedgerTotalsRow
+	From        string
+	To          string
+	UserID      string
+	Kind        string
+	Wallet      string
+	Provider    string
+	Kinds       []string
+	Wallets     []string
+	Providers   []string
+	FilterQuery template.URL
+}
+
+// LedgerRow is one operation in the ledger list. Money is the amount the customer paid or was
+// refunded, already formatted with its currency, and empty for a row that moved no money (a chip
+// spend, an admin grant, a rewarded-video credit). Refundable marks a funded order the operator may
+// still reverse, which is what puts the Refund button on that row.
+type LedgerRow struct {
+	At         string
+	AccountID  string
+	Kind       string
+	Source     string
+	Origin     string
+	ChipsDelta int
+	Money      string
+	Title      string
+	Order      string
+	Provider   string
+	Shop       string
+	Refundable bool
+}
+
+// LedgerTotalsRow is the summary above the table, over everything the filter matches. Money is
+// listed per currency because the rails settle in different ones and one sum across them would mean
+// nothing.
+type LedgerTotalsRow struct {
+	MoneyIn       []string
+	MoneyRefunded []string
+	ChipsIn       int
+	ChipsOut      int
+}