feat(canopy-reporting): wire CMS-64 expenditure aggregation from MMIS

Context

aggregate_cms64 in services/canopy-reporting/src/reporting/medicaid.rs:184-255 inserts only enrollment counts. CMS-64 expenditure category is set to coverage_group and member_months ≈ enrolled (line 239 comment).

The HTTP handler at api/mod.rs:587 literally returns "status": "generated (expenditures NULL — requires MMIS)" — admits the gap to callers. CMS-64 is a quarterly federal expenditure report and the NULL columns block submission.

Acceptance criteria

• MMIS integration shape decided (file feed? API?)
• Per-category expenditure population matching CMS-64 line item taxonomy
• Member-months computation refined (currently approximated as enrolled count)
• Integration test covering one non-NULL category
• HTTP handler stops emitting the placeholder status string
• CHANGELOG entry under Changed

Surfaced by

Multi-agent plan-vs-code audit, 2026-05-05.