parser + P60 ingest: split income_tax cash/RSU, add P60 ground-truth

Meta variant-B payslips gross up Taxable Pay for RSU and compute PAYE on
the grossed-up figure, so `income_tax` on the slip is the total PAYE
(cash + RSU-attributed). Dashboards that stacked the raw figure made
vest-month tax look ~2x higher than "cash tax paid". Introduce
`cash_income_tax = income_tax * (gross_pay - pension_sacrifice) /
taxable_pay` as a derived column alongside the raw figure. Dashboards
can now stack cash vs RSU-attributed tax as separate segments.

Also capture YTD column values of `RSU Tax Offset` and `RSU Excs Refund`
from the Payments grid — needed for reconciliation against HMRC annual
figures.

P60 ingest: new parser under `parsers/p60.py` anchoring on statutory
HMRC line labels (`Tax year to 5 April YYYY`, `Employer PAYE reference`,
`In this employment` pay/tax row, NI letter bands). Processor routes
documents carrying the `p60` Paperless tag to `_handle_p60` which
writes to the new `payslip_ingest.p60_reference` table (one row per
tax_year+employer). App lifespan resolves the tag id at startup; missing
tag disables dispatch without breaking payslip ingest. Paperless tag
creation + webhook config are manual follow-ups.

Migrations:
- 0004 — cash_income_tax + ytd_rsu_tax_offset + ytd_rsu_excs_refund on
  payslip, all nullable.
- 0005 — p60_reference table with (tax_year, employer) unique +
  paperless_doc_id unique for idempotent re-uploads.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

tests/test_processor.py

@@ -246,3 +246,45 @@ async def test_rejects_zero_gross_zero_net(paperless: AsyncMock, extractor: Asyn
     factory = _SessionFactory([_FakeSession(existing_ids=[])])
     with pytest.raises(ValueError, match="zero gross and net"):
         await process_document(42, factory, paperless, extractor)
+
+
+async def test_p60_tag_routes_to_p60_handler(paperless: AsyncMock, extractor: AsyncMock,
+                                             monkeypatch: pytest.MonkeyPatch) -> None:
+    """A doc carrying the P60 tag id goes to _handle_p60 (not the payslip path)."""
+    p60_text = (FIXTURES / "meta_uk_p60_2024_25.txt").read_text(encoding="utf-8")
+    monkeypatch.setattr(processor, "_pdftotext", lambda _: p60_text)
+    paperless.get_document.return_value = {"id": 42, "title": "P60 2024-25", "tags": [7]}
+
+    # Two sessions: one for combined dedup, one for the P60 insert.
+    factory = _SessionFactory([
+        _FakeSession(existing_ids=[]),
+        _FakeSession(existing_ids=[]),
+    ])
+    result = await process_document(42, factory, paperless, extractor, p60_tag_id=7)
+
+    assert result.status == "inserted"
+    assert result.extractor == "p60_regex"
+    assert result.p60_id == 1
+    # Extractor (Claude) must not be called for a P60.
+    extractor.extract.assert_not_called()
+    inserted_row = factory.used[1].added[0]
+    assert inserted_row.tax_year == "2024/25"
+    assert inserted_row.gross_pay == Decimal("232630.34")
+    assert inserted_row.income_tax == Decimal("95820.11")
+
+
+async def test_p60_tag_absent_follows_payslip_path(paperless: AsyncMock, extractor: AsyncMock,
+                                                   monkeypatch: pytest.MonkeyPatch) -> None:
+    """A regular payslip (no P60 tag) still goes through the payslip path."""
+    meta_text = (FIXTURES / "meta_uk_2026_02.txt").read_text(encoding="utf-8")
+    monkeypatch.setattr(processor, "_pdftotext", lambda _: meta_text)
+    paperless.get_document.return_value = {"id": 42, "title": "Payslip", "tags": [3]}
+
+    factory = _SessionFactory([
+        _FakeSession(existing_ids=[]),
+        _FakeSession(existing_ids=[]),
+    ])
+    result = await process_document(42, factory, paperless, extractor, p60_tag_id=7)
+    assert result.status == "inserted"
+    assert result.extractor == "meta_uk_regex"
+    assert result.p60_id is None