add dolibarr-payments-state skill for cash receipt tracking

V2 in the dolibarr-* family. Three workflows:

- km-payment-state.sh: per-invoice reconciliation (TTC vs sum of
  payments) with OK / PARTIAL / UNPAID / OVERPAID classification.
  More honest than the `paye` boolean for deferred-cycle agreements.
- km-payment-timeline.sh: all KM payments sorted by date with
  cumulative balance — the foundation for cohort-review deferred
  9-month-cycle tracking (actual cash receipts vs contractual schedule).
- payments-by-month.sh: monthly aggregation, KM-scoped by default
  or --all-clients for accounting basis.

Also updates dolibarr/SKILL.md endpoint catalogue with
/invoices/{id}/payments (note the date-as-string vs unix-epoch quirk)
and /bankaccounts, plus captures the corresponding examples.

V1 baseline of live data: KM is fully reconciled across 5 invoices
(1 avoir + 4 regular), 8160 € total cash receipts spread Feb/Mar/Apr 2026,
all on WISE EURO (BE).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.claude/skills/dolibarr/SKILL.md

@@ -88,6 +88,9 @@ Read-only endpoints we've validated against this instance. Live captures are und
 | `GET /users/info`                              | 200  | Current API user (auth sanity)       | Returns `login`, `id`, `rights` tree                             | [users_info.json](examples/users_info.json) |
 | `GET /invoices`                                | 200  | List invoices                        | `limit`, `sortfield=t.datef`, `sortorder=DESC`, `status=draft\|unpaid\|paid`, `sqlfilters` | [invoices_list.json](examples/invoices_list.json) |
 | `GET /invoices/{id}`                           | 200  | Invoice detail                       | `paye=1` is the canonical "paid" flag                            | [invoice_detail.json](examples/invoice_detail.json) |
+| `GET /invoices/{id}/payments`                  | 200  | Payments applied to one invoice      | Returns array of `{amount, type, date, num, ref, fk_bank_line}`. **`date` is a string `YYYY-MM-DD HH:MM:SS`, NOT unix epoch** like elsewhere. Amounts negative for AVOIRs. | [invoices_12_payments.json](examples/invoices_12_payments.json) |
+| `GET /payments`                                | 501  | (list-all not implemented)           | Returns "API not found". To enumerate payments, iterate invoices. | — |
+| `GET /bankaccounts` / `/{id}`                  | 200  | List bank accounts / detail          | Returns `ref`, `label`, `iban`, `country_code`. `fk_bank_line` on a payment doesn't directly map to the account id — see `dolibarr-payments-state` skill for the lookup. | [bankaccounts_list.json](examples/bankaccounts_list.json) |
 | `GET /thirdparties`                            | 200  | List thirdparties                    | `mode` MUST be integer (`mode=1` = customers). String fails 400. | (use `/{id}` below) |
 | `GET /thirdparties/{id}`                       | 200  | Thirdparty detail                    | KissMetrics is `id=1` in this instance                           | [thirdparty_km.json](examples/thirdparty_km.json) |
 | `GET /products` / `/products/{id}`             | 200  | Product catalogue                    | `KM-audit` is `id=1`                                             |  — |
@@ -118,11 +121,12 @@ Not available on this account (intentionally): `/setup/modules` (admin-only), `/
 
 - **`mode` is an integer.** `?mode=1` works; `?mode=customer` → HTTP 400 `Invalid value specified for mode`.
 - **Empty list vs 404 vs 403.** `/invoices` returns `[]` (200) on empty/permission-filtered. `/thirdparties` returns 404 `"No third parties found"`. `/thirdparties/{id}` returns 403 if the ACL hides the row. All three can mean "no permission" — the diagnostic is to hit `/thirdparties/1` directly (see Permission gotcha above).
-- **Dates are unix epoch (seconds).** `.date`, `.datef`, `.date_lim_reglement`, `.tms` are integers.
+- **Dates are usually unix epoch (seconds)** on most objects: `.date`, `.datef`, `.date_lim_reglement`, `.tms` are integers.
   ```bash
   python3 -c "import datetime,sys; print(datetime.datetime.fromtimestamp(int(sys.argv[1])))" 1771887600
   # → 2026-02-24 00:00:00
   ```
+  **Exception**: `/invoices/{id}/payments` returns `.date` as the string `"YYYY-MM-DD HH:MM:SS"`, not an int. Check the field type before parsing.
 - **`paye` is the paid flag, `status` is the workflow state.** `status=2` means "validated", `paye=1` means "fully paid". They're independent — a status-2 invoice can still be unpaid.
 - **`last_main_doc` paths** are relative to Dolibarr's document root. For `/documents/download`, pass `modulepart=facture` + URL-encoded `original_file=<dir>/<file>` (encode the `/`).
 - **`array_options=[]` vs `{}`.** Dolibarr returns `[]` when no extrafields are set and `{}` when there are some. Treat both as "no custom fields" in Python.
@@ -130,6 +134,7 @@ Not available on this account (intentionally): `/setup/modules` (admin-only), `/
 ## Pointers
 
 - Workflow skill for invoice + thirdparty audits: [dolibarr-invoice-audit](../dolibarr-invoice-audit/SKILL.md).
+- Workflow skill for payment-state and cash-receipt tracking: [dolibarr-payments-state](../dolibarr-payments-state/SKILL.md).
 - Future workflow skills follow the `dolibarr-<topic>` convention. Each one depends on this skill for connection + permissions + endpoint reference; each one keeps its triggers focused on its specific business workflow.
 
 ## Out of scope