Phase B of RSU tax spike fix. Vest-month spikes on the dashboard trace to
variant-A slips (2019–mid-2022) where `cash_income_tax` is NULL — the
dashboard's COALESCE fallback returns full PAYE, masquerading as cash tax.
Three changes:
1. Widen variant-A Taxable Pay regex. Original pattern only matched
`Taxable Pay : This Period £...`; add case-insensitive variants that
tolerate missing/different colons, elided "This", and uppercase labels.
Covers older 2019-2020 templates that failed the previous match.
2. New `backfill_cash_income_tax` module — walks every NULL-cash-tax row
with rsu_vest > 0, re-downloads the PDF from Paperless, runs the
widened regex parser, falls back to Claude for taxable_pay extraction
if regex still misses, and derives cash_income_tax pro-rata. Records
provenance in new `cash_income_tax_source` column (regex/claude/
fallback_null). Idempotent — only touches NULL rows.
3. Migration 0006 adds the `cash_income_tax_source` audit column.
CLI: `python -m payslip_ingest backfill-cash-tax [--limit N]`. Meant to
run as a one-shot K8s Job after `alembic upgrade head`.
Part of: code-860
3b9c69bfd3