security: remove NetSuite credentials and account IDs from docs and reports

fix(oauth): include path query params in PATCH signature (?replace=expense) + 401 hint

docs: reorganize into docs/ + feat(vendor-bills): full netsuite_update_vendor_bill (header, expense, item, billing, custom, dryRun, replace)

fix(suiteql): align URL, params and response with Oracle SuiteQL specs

fix(suiteql): remove canUseSuiteQL guard — always attempt query, let NetSuite respond

feat(expense-reports): category required per line, accountingApproval, get by id + categories items

feat(expense-reports): add Format D — body.expense.items like vendor bills (default)

feat: create_expense_report — expenseListFormat A|B|C for debugging NS REST format

fix: create_expense_report — expenseList.items (not expenseList.expense.items) for NS REST

fix: create_expense_report — explicit JSON.parse for expenseList string (MCP), remove parseParam import

feat: parseParam, dryRun, get_record_schema, expenseList.items — debug + schema + safe params

fix: create_expense_report — expenseList.expense.items[] (NS REST sub-resource pattern)

feat: create_expense_report — expenseList inputSchema (Zod) with expense lines structure

fix: create_expense_report — add body.entity for NS REST (employee + entity)

fix: create_expense_report — explicit body.employee/subsidiary/currency = { id } assignments