fix: cash record policy, observer, n+1 query

tests/Feature/CashRecordObserverTest.php

@@ -82,8 +82,14 @@ class CashRecordObserverTest extends TestCase
         $record = $this->makeRecord(100_000);
         $record->update(['verified_by' => $this->user->id, 'verified_at' => now()]);
 
-        $this->expectException(\Illuminate\Auth\Access\AuthorizationException::class);
+        // Beri permission Delete:CashRecord agar Policy logic yang diuji (bukan permission check)
+        \Spatie\Permission\Models\Permission::firstOrCreate(['name' => 'Delete:CashRecord', 'guard_name' => 'web']);
+        $this->user->givePermissionTo('Delete:CashRecord');
 
-        $record->delete();
+        // CashRecordPolicy::delete() return false jika verified_at !== null
+        $this->assertFalse(
+            $this->user->can('delete', $record),
+            'User seharusnya tidak bisa menghapus transaksi yang sudah diverifikasi.'
+        );
     }
 }