fix(sync): dashboard sync covers current year plus Nov-Dec of previous

/sync-bank now uses one shared default window in both implementations:
1 November of the previous year to 31 December of the current year.
Payments dated around New Year are picked up in January; duplicates
are still filtered by Sync ID.

Python used a hardcoded 2026 window and would have stopped syncing on
2027-01-01; Go used the current calendar year only.

Adds make sync-year [YEAR=N] with the same window. The CLI default
without flags (last 30 days) is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

legacy/tests/test_app.py

@@ -23,6 +23,20 @@ class TestWebApp(unittest.TestCase):
         app.config['TESTING'] = True
         self.client = app.test_client()
 
+    @patch('app.flush_cache', return_value=0)
+    @patch('app.infer_payments')
+    @patch('app.sync_to_sheets')
+    def test_sync_bank_uses_default_window(self, mock_sync, mock_infer, mock_flush):
+        """/sync-bank syncs the current year plus Nov-Dec of the previous one, not a hardcoded year."""
+        from datetime import datetime
+        year = datetime.now().year
+        response = self.client.get('/sync-bank')
+        self.assertEqual(response.status_code, 200)
+        kwargs = mock_sync.call_args.kwargs
+        self.assertEqual(kwargs['date_from_str'], f"{year - 1}-11-01")
+        self.assertEqual(kwargs['date_to_str'], f"{year}-12-31")
+        mock_infer.assert_called_once()
+
     def test_index_page(self):
         """Test that / returns the refresh meta tag"""
         response = self.client.get('/')