[IMP] tax_receipt_in_portal: pick report per company, hide missing PDFs

Replace the ``tax_receipt_in_portal.report_uuid`` system parameter by a
per-company setting, in Settings > Invoicing > Tax Receipts
(``res.company.tax_receipt_report_id``). Each receipt is rendered with
the report of its issuing company, not the current one: in the portal,
the current company is the website's. The selector only offers PDF Form
reports on ``l10n.fr.tax.receipt``; type and model are still checked at
rendering time since the report can be edited after selection.

The download buttons of the list and detail pages are only shown when
the PDF can actually be rendered: a valid report is configured for the
issuing company and no mapped field resolves to an empty value. The
checks are those of the rendering itself, exposed as a filter
(``_get_pdf_available_receipts``) and run in sudo to avoid false
negatives on field paths the donor cannot read. Otherwise a discreet
"PDF available soon" mention replaces the button, and the download URL
redirects to the receipt page.

The detail page download link now also carries the share token, so a
visitor reaching the page by token can download the PDF.

tax_receipt_in_portal/README.rst

@@ -57,24 +57,26 @@ installed automatically.
 Configuration
 =============
 
-One system parameter is required
-(:menuselection:`Settings --> Technical --> System Parameters`):
+Select the report rendering tax receipts in
+:menuselection:`Settings --> Invoicing --> Tax Receipts --> Tax Receipt
+Report`.
 
-==================================== =========================================
-Key                                  Value
-==================================== =========================================
-``tax_receipt_in_portal.report_uuid`` The ``report_uuid`` of the PDF Form
-                                     report that renders tax receipts.
-==================================== =========================================
+The setting is **per company**: each receipt is rendered with the report of
+its *issuing* company (``company_id`` of the receipt), not the current one —
+in the portal, the current company is the website's.
 
-A UUID is used rather than a database id so the configuration survives a
-restore on another database. The report must:
+The selector only offers reports that:
 
-* be of type ``PDF Form`` (``report_type = pdf_form``);
-* target the model ``l10n.fr.tax.receipt``.
+* are of type ``PDF Form`` (``report_type = pdf_form``);
+* target the model ``l10n.fr.tax.receipt``;
+* belong to the company, or are shared (no company).
 
-Anything else raises an explicit error at download time instead of serving
-a wrong document.
+These conditions are checked again at rendering time, since a report can be
+edited after being selected. Deleting the selected report empties the
+setting.
+
+Without a valid report, donors still see their receipts, but no download
+button: a discreet "PDF available soon" mention replaces it.
 
 Bind the PDF fields to receipt field paths, for instance:
 
@@ -94,6 +96,12 @@ Usage
 Donors see only their own receipts, and only once **confirmed**. Confirming
 a receipt in the back office is therefore what publishes it.
 
+A download button is shown only when the PDF can actually be rendered: a
+report is configured for the issuing company and no mapped field resolves
+to an empty value. Otherwise the button is replaced by a "PDF available
+soon" mention, and a direct call to the download URL redirects to the
+receipt page.
+
 Security
 ========
 
@@ -142,6 +150,10 @@ Known issues / Roadmap
 * **No archiving.** The PDF is rendered at each download and never stored.
   A receipt whose rendering becomes impossible (report deleted or
   reconfigured) can no longer be served, even though it was already sent.
+* **Availability is evaluated at each display.** Deciding whether to show
+  the download button resolves every mapped PDF field of each displayed
+  receipt — at most one page of the list. A report with costly Python
+  expressions slows the list down accordingly.
 * **No email notification** and **no portal account invitation**: a donor
   without a portal account cannot reach the page. Both are deliberately
   out of scope.