fix(phase3): subscription leak, image mime type validation

- Ledger store: add stopSubscription() to properly clean up realtime
  subscriptions, matching asset store pattern
- LedgerList: call stopSubscription on unmount
- Assets migration: restrict image upload to image/* mime types
  (C3 updateRule is a known tradeoff — PocketBase lacks field-level
  permissions, frontend enforces edit restrictions instead)

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

backend/pb_migrations/1776510002_created_assets.js

@@ -112,7 +112,7 @@ migrate((db) => {
         "presentable": false,
         "unique": false,
         "options": {
-          "mimeTypes": null,
+          "mimeTypes": ["image/*"],
           "thumbs": ["200x200"],
           "maxSelect": 1,
           "maxSize": 5242880,