retire the bunq integration

The webhook is deregistered at bunq and the callback endpoint, its parser,
default-deny classifier, dedup ledger and signature check are removed; the
code is in git history if a bank feed ever comes back. /financials keeps
reading the hand-maintained aggregates file, and sales + shop donations
stay live from the order ledger.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

project.cpp

@@ -87,9 +87,9 @@ static Configuration* SharedLibrary(std::span<const std::string_view> args) {
 // Catcrafts.ServerCore — every implementation unit of the server except
 // main.cpp, as a static library. The split exists for the tests: a test can
 // only LINK a library-type dependency (crafter-build exports -L/-l for
-// libraries alone), and the Mollie/EURC/Sendcloud parsers, the invoice
-// builder and the bunq classifier all live here. The exe is main.cpp plus
-// this library, so the split costs nothing at deploy time.
+// libraries alone), and the Mollie/EURC/Sendcloud parsers and the invoice
+// builder all live here. The exe is main.cpp plus this library, so the
+// split costs nothing at deploy time.
 //
 // Same `static unique_ptr` convention as SharedLibrary, and the same warning:
 // cfg.dependencies holds a raw pointer, so the Configuration must outlive
@@ -121,13 +121,11 @@ static Configuration* ServerCore(std::span<const std::string_view> args, Configu
     core->GetInterfacesAndImplementations(ifaces, impls);
 
     // Both rails reach their provider over TLS, which is what libssl is for
-    // here. libcrypto is named again on its own account: the bunq mutation
-    // callback verifies an RSA-SHA256 body signature through EVP, so this
-    // library calls libcrypto directly rather than only inheriting it as
-    // libssl's dependency. On the lib rather than the exe because link flags
-    // propagate to consumers — the exe and every test get them from here.
+    // here; libcrypto arrives as its dependency. (It was named explicitly
+    // while the bunq callback verified RSA body signatures through EVP — that
+    // integration is retired.) On the lib rather than the exe because link
+    // flags propagate to consumers — the exe and every test get them from here.
     core->linkFlags.push_back("-lssl");
-    core->linkFlags.push_back("-lcrypto");
     return core.get();
 }