Create a VAT / tax code

Adds a VAT rate to the central registry. This is a back-office MAINTENANCE operation: the created code immediately becomes a selectable tax code a product can reference. The code is caller-supplied and is its identity — pick a stable, URL-safe token (e.g. FR-RED), because it is the handle every other maintenance verb addresses it by; 409s when a code already carries it (a create never overwrites — use update instead). rateBps is the rate in BASIS POINTS (5.5% → 550), country is an optional ISO alpha-2, and active defaults to true. PERMISSION TRAP (see solya-pos#950): the route guard accepts pos.settings.manage, but the use-case additionally asserts the kernel config:manage permission and NO pos.settings.* scope maps to it, so a principal authenticated by scopes alone clears the guard and then 403s inside the use-case.