Add virtual parent accounts for permission inheritance

Implements metadata-only accounts (e.g., "Expenses", "Assets") that exist
solely in Castle DB for hierarchical permission management. These accounts
don't exist in Beancount but cascade permissions to all child accounts.

Changes:

**Migration (m003)**:
- Add `is_virtual` BOOLEAN field to accounts table
- Create index idx_accounts_is_virtual
- Insert 5 default virtual parents: Assets, Liabilities, Equity, Income, Expenses

**Models**:
- Add `is_virtual: bool = False` to Account, CreateAccount, AccountWithPermissions

**CRUD**:
- Update create_account() to pass is_virtual to Account constructor

**Account Sync**:
- Skip deactivating virtual accounts (they're intentionally metadata-only)
- Virtual accounts never get marked as inactive by sync

**Use Case**:
Admin grants permission on virtual "Expenses" account → user automatically
gets access to ALL real expense accounts:
- Expenses:Groceries
- Expenses:Gas:Kitchen
- Expenses:Maintenance:Property
- (and all other Expenses:* children)

This solves the limitation where Beancount doesn't allow single-level accounts
(e.g., bare "Expenses" can't exist in ledger), but admins need a way to grant
broad access without manually selecting dozens of accounts.

Hierarchical permission inheritance already works via account_name.startswith()
check - virtual accounts simply provide the parent nodes to grant permissions on.

🤖 Generated with Claude Code (https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

models.py

@@ -37,6 +37,7 @@ class Account(BaseModel):
     user_id: Optional[str] = None  # For user-specific accounts
     created_at: datetime
     is_active: bool = True  # Soft delete flag
+    is_virtual: bool = False  # Virtual parent account (metadata-only, not in Beancount)
 
 
 class CreateAccount(BaseModel):
@@ -44,6 +45,7 @@ class CreateAccount(BaseModel):
     account_type: AccountType
     description: Optional[str] = None
     user_id: Optional[str] = None
+    is_virtual: bool = False  # Set to True to create virtual parent account
 
 
 class EntryLine(BaseModel):
@@ -342,6 +344,7 @@ class AccountWithPermissions(BaseModel):
     user_id: Optional[str] = None
     created_at: datetime
     is_active: bool = True  # Soft delete flag
+    is_virtual: bool = False  # Virtual parent account (metadata-only)
     # Only included when filter_by_user=true
     user_permissions: Optional[list[PermissionType]] = None
     inherited_from: Optional[str] = None  # Parent account ID if inherited