NWP-101: add export options

[Shalinparikh]

Ticket

Closes NWP-101

What changed

The export button on /payments now opens a slide-over dialog instead of downloading immediately. Ops can choose which columns to include — card last-four is unchecked by default so merchant-facing files never need manual cleanup. They can also choose scope (current filter or all payments) and see the row count for each option before clicking Download. Selecting zero columns disables the Download button rather than producing an empty file. The filename now reflects the scope and date (e.g. payments-disputed-2026-08-13.csv). Column names sent by the client are validated server-side against an allowlist; unknown names are silently dropped and an empty selection returns HTTP 400.

How I verified it

• npm test passes
• New behavior is covered by a test
• Checked it in the browser

npm test summary: 33 passed across 3 test files (14 in csv.test.ts, up from 9). npx tsc --noEmit clean.

Browser (dev server on :3000): clicked Export on /payments — drawer opened with column checkboxes (last-four unchecked) and scope radios showing current-filter and all-payments row counts. Unchecking all columns disabled the Download button. Downloading with a status filter active produced payments-disputed-<date>.csv with only the selected columns. Switching scope to "All payments" produced a larger row count and the filename changed to payments-all-<date>.csv.

Tamper check: ?columns=id,evil,amount dropped evil; ?columns= returned 400.

Acceptance criteria

• Ops can choose which columns are included. Card last-four is off by default.
• Ops can choose scope: current filter or all payments. Current filter is the default, and the row count is visible before download.
• The filename reflects the scope and the date (e.g. payments-disputed-2026-08-13.csv).
• Amounts stay in minor units internally and are formatted once on the way out, with currency in its own column.
• Deselecting every column disables Download rather than producing an empty file.

Bugs fixed along the way

None found.

Notes for the reviewer

exportFilename signature changed from (date?) to (scopeSlug?, date?) — the existing test was updated to pass undefined as the first arg so the date-stamping contract is still pinned. The package-lock.json change normalises the package name from template-planner to merchant-console (matching package.json); no dependencies changed.