feat: Bank Transfers: soft-delete, status, and tracking categories

[jeremy-drummond-xero]

Overview

Extends the Accounting OpenAPI spec for /BankTransfers to reflect new endpoint capabilities: soft-deleting transfers (single and bulk), a Status field on responses, and tracking categories on reads and create.

Changes

New Status field (BankTransfer schema, read-only)

• Added to all GET and create responses. Values: AUTHORISED or DELETED.

New tracking categories (BankTransfer schema)

• Added FromTracking and ToTracking arrays, surfaced on GET (index + by-id) and create responses.
• Introduces a TrackingReference schema: TrackingCategoryID + TrackingOptionID on write; resolved Name + Option echoed back on read (read-only). Max 2 per account.

Soft-delete operations (two new POST operations)

• deleteBankTransfer — POST /BankTransfers/{BankTransferID}, single transfer; body carries Status: DELETED (BankTransferDelete schema).
• deleteBankTransfers — POST /BankTransfers, bulk array of {BankTransferID, Status} (BankTransfersDelete schema).
• Both return the deleted transfer(s) with Status: DELETED.

New includeDeleted query parameter (GET /BankTransfers)

• Opt-in boolean to include DELETED transfers in the index response. Default behaviour (deleted excluded) is unchanged.

[jeremy-drummond-xero]

I named the soft-delete ops delete* (not update*): delete is the only mutation the endpoint honours today — any other field-update 400s — and delete* keeps us consistent with deletePayment/deleteBatchPayment. The one tension is that if transfers ever become editable, renaming delete*→update* is a breaking SDK change for a non-breaking API addition — but I've check and it looks like SDK versions can be managed independently of the spec, so that rename can be absorbed without forcing a spec-version break.

[jeremy-drummond-xero]

Introduced TrackingReference rather than reusing TrackingCategory or LineItemTracking because the bank transfer tracking contract is write-by-ID-only with names echoed back on read. That requires Name/Option to be readOnly. TrackingCategory is the wrong entity (carries Status + nested Options[]), and LineItemTracking presents Name/Option as writable — reusing either would have the contract slightly wrong.