Money: private Documents page with admin-only file endpoint

Lists contracts/pension docs with written summaries, an inline viewer and
download at /trackers/money/documents. Files and summaries live on the host
(MONEY_DOCUMENTS_ROOT, bind-mounted read-only by deploy-remote.sh), never in
git or static/; the file endpoint is admin-only (401/403) and private, no-store.

src/routes/trackers/money/+page.svelte

@@ -15,6 +15,7 @@
 	import Trash2 from 'lucide-svelte/icons/trash-2';
 	import Upload from 'lucide-svelte/icons/upload';
 	import Download from 'lucide-svelte/icons/download';
+	import FileText from 'lucide-svelte/icons/file-text';
 	import MoneyChart from '#lib/money-tracker/MoneyChart.svelte';
 	import QuickAdd from '#lib/money-tracker/QuickAdd.svelte';
 	import { compactAmount, sortWishlist, tierClass } from '#lib/money-tracker/wishlist.js';
@@ -281,7 +282,9 @@
 			<h1>Money</h1>
 		</div>
 		<div class="header-actions">
-			<Button variant="outline" onclick={() => open('import')}
+			<Button variant="outline" href={resolve('/trackers/money/documents')}
+				><FileText size={16} /> Documents</Button
+			><Button variant="outline" onclick={() => open('import')}
 				><Upload size={16} /> Import CSV</Button
 			><Button onclick={() => open('transaction')}><Plus size={16} /> Add transaction</Button>
 		</div>