retire the bunq integration

The webhook is deregistered at bunq and the callback endpoint, its parser,
default-deny classifier, dedup ledger and signature check are removed; the
code is in git history if a bank feed ever comes back. /financials keeps
reading the hand-maintained aggregates file, and sales + shop donations
stay live from the order ledger.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.gitignore

@@ -21,13 +21,6 @@ media/
 orders.jsonl
 *.fake-paid
 *.financials.json
-*.financials-seen.json
-*.financial-rules.json
-bunq-state.json
-# tools/bunq-callback.sh's client keypair (a PRIVATE key) and the bunq server
-# public key it saves for BUNQ_CALLBACK_PUBKEY. Home-machine credentials.
-bunq-client-key.pem
-bunq-server-public-key.pem
 
 .env