Add `allow_secondary` flag to rules

[michaelbeutler]

Add an allow_secondary boolean field to rules. When a document matches multiple rules, the highest-priority match is the primary (moved + renamed). Rules with allow_secondary: true that also match become secondary — only symlinks are created for them.

Example Config

rules:
  - id: bank-statements
    priority: 100
    match:
      contains_all: ["Kontoauszug", "Bank"]
    output:
      directory: "Bank/Statements/$y"
      filename: "$y_$m_bank_statement"

  - id: tax-docs
    priority: 50
    allow_secondary: true   # NEW
    match:
      contains: "Bank"
    symlinks:
      - target: "Taxes/$y/Documents"

Implementation

Schema change:

• File: crates/paporg/src/config/schema.rs
• Add allow_secondary: Option<bool> to Rule (line ~85), default false

Pipeline change:

• File: crates/paporg/src/pipeline/runner.rs
• After primary categorization (step 4), collect secondary matches where allow_secondary == true
• In step_create_symlinks() (line ~341): also create symlinks from secondary matches
• Secondary rules only contribute their symlinks config — they do NOT affect output (no move/rename)

Depends on: Issue #44 (return all matching rules)

Acceptance Criteria

• allow_secondary: true rules create symlinks when matched as secondary
• allow_secondary: false (default) rules are ignored when not primary
• Primary rule still controls output path and filename
• Secondary rules only contribute symlinks
• A rule can be both primary (if highest priority) or secondary (if outranked)
• Covered by unit tests and integration test