Add AssetItem.cost/costCurrency/externalPoNumber, make import upsert-capable

Three new fields: cost (Decimal, not Float -- exact money math),
costCurrency (free text), externalPoNumber (free text PO number from an
external system, distinct from purchaseOrderId which is a real FK into
this apps own PurchaseOrder table -- external exports PO numbers are
messy free text with nothing to link to here).

importAssetItems() now upserts: a row matching an existing assetTag or
serialNumber updates that row instead of erroring on the uniqueness
conflict. Needed to backfill cost/PO onto the 613 already-imported rows
without recreating them, and sets this up for future re-syncs when the
company re-exports their ITAM report. Update only touches fields the row
actually carries a value for (blank cell = no change, not clear) --
warrantyEndDate is the one field NOT auto-recomputed from warrantyMonths
on update (unlike create), so a manually-corrected date survives a
re-sync. Placeholder junk (Not available/Pending/N/A/etc, case
-insensitive) in PO number/cost/currency cells is treated as absent.

Re-ran the full 613-row import after this: 0 created, 613 updated, 0
errors -- backfilled cost onto the 8 rows that had one and PO number onto
the 2 that had a real (non-placeholder) value, verified against the
source file.

Hand-written migration, no Vitest coverage -- same deviation as the rest
of this branch, see CLAUDE.md. tsc/lint clean.

prisma/schema.prisma

@@ -139,8 +139,23 @@ model AssetItem {
   purchaseDate       DateTime?            @map("purchase_date") @db.Date
   warrantyEndDate    DateTime?            @map("warranty_end_date") @db.Date
   status             AssetItemStatus      @default(in_stock)
+  // Purchase cost, in `costCurrency`'s units -- added 2026-08-24 alongside
+  // externalPoNumber for the real ITAM export (very sparse there: 8/613
+  // rows had a nonzero cost). Decimal, not Float, for exact money math (no
+  // binary-float rounding drift) -- Decimal(14,2) comfortably covers VND
+  // amounts in the millions with room to spare.
+  cost               Decimal?             @db.Decimal(14, 2)
+  costCurrency       String?              @map("cost_currency")
   purchaseOrderId    String?              @map("purchase_order_id") @db.Uuid
   purchaseOrder      PurchaseOrder?       @relation(fields: [purchaseOrderId], references: [id])
+  // Free-text PO number from an external system (e.g. the real ITAM
+  // export's "PO number" column) -- deliberately NOT the same thing as
+  // purchaseOrderId above, which is a real FK into this app's own
+  // PurchaseOrder table. External exports' PO numbers are messy free text
+  // ("Not available", "Pending", or an actual number) with no matching
+  // PurchaseOrder row to link to here, so this just preserves the raw
+  // value for reference instead of forcing a fake relation.
+  externalPoNumber   String?              @map("external_po_number")
   createdAt          DateTime             @default(now()) @map("created_at") @db.Timestamptz(6)
   // Back-relation for Assignment.assetItemId — an AssetItem can have
   // multiple Assignment rows over its lifetime (historical + at most one