Batch Analyse requests and survive opaque provider schema budgets

Analyse now classifies up to ten same-kind transactions per provider
request: the registry and history travel once per batch, so a
thousand-row backfill costs about a hundred paced requests instead of a
thousand. The answer schema appears once — an array item carrying an
enum-bound ref — because providers meter strict schemas by token cost:
duplicating registry enums per row, or bounding arrays with
minItems/maxItems that Gemini expands per element, rejects real
registries with a bare HTTP 400. Row count, duplicate refs, duplicate
tags and taxonomy bounds are all enforced server-side instead, and a
request still rejected outright halves until accepted, remembering the
working size for the run. Batch requests scale the HTTP budget by row
count, chunk failures cannot abort a run whose later rows succeeded,
and rows resolved against one snapshot share one minted merchant.

Measured on a real 165-row month over a zero-data-retention route:
165 analysed, 152 proposals, 0 errors, 17 requests, under 8 minutes.

Fresh installs default to google/gemini-3.8-flash, the model that
demonstrably honors strict structured outputs over a ZDR route. Preview
changes now carry counterparty, amount and currency, and the review
list shows the amount with a counterparty fallback for banks that leave
descriptions empty.

internal/app/openrouter_test.go

@@ -29,14 +29,15 @@ func checkOpenRouterPreview(t *testing.T, a *App, s State, auth <-chan string, k
 			if change.After.CategoryID != "groceries" {
 				t.Fatal("provider classification was not applied to the preview")
 			}
-			select {
-			case got := <-auth:
-				if got != "Bearer "+key {
-					t.Fatal("provider received the wrong Authorization credential")
-				}
-			default:
-				t.Fatal("classification did not reach the provider")
+		}
+		// Both rows share one kind, so the whole preview is one batch request.
+		select {
+		case got := <-auth:
+			if got != "Bearer "+key {
+				t.Fatal("provider received the wrong Authorization credential")
 			}
+		default:
+			t.Fatal("classification did not reach the provider")
 		}
 	}
 	select {