feat(expenses): add authoritative pre-review workflow

server/src/app/services/expense_claim_rule_fingerprint.py

@@ -0,0 +1,27 @@
+from __future__ import annotations
+
+import hashlib
+import json
+from typing import Any
+
+
+def build_risk_manifest_fingerprint(manifests: list[dict[str, Any]]) -> str:
+    ordered_manifests = sorted(
+        manifests,
+        key=lambda manifest: json.dumps(
+            manifest,
+            ensure_ascii=False,
+            sort_keys=True,
+            separators=(",", ":"),
+            default=str,
+        ),
+    )
+    normalized = json.dumps(
+        ordered_manifests,
+        ensure_ascii=False,
+        sort_keys=True,
+        separators=(",", ":"),
+        default=str,
+    )
+    digest = hashlib.sha256(normalized.encode("utf-8")).hexdigest()
+    return f"sha256:{digest}"