feat(idurar-erp-crm): add DTO layer to strip internal fields from API responses

[augmentcode]

Problem

All CRUD controller methods returned raw Mongoose documents directly, which exposed internal MongoDB/Mongoose fields — __v (version key) and removed (soft-delete flag) — to API clients. These are implementation details that have no business value for consumers.

Solution

Added a minimal sanitizeDocument utility (backend/src/utils/sanitizeResponse.js) that converts a Mongoose document (or array) to a plain object and strips __v and removed. Applied centrally across all controller response paths:

• createCRUDController — create, read, update, remove, listAll, paginatedList, search, filter
• invoiceController — create, update, read, remove, paginatedList
• paymentController — create, update, remove

_id is preserved so existing frontend references continue to work.

---

Pull Request opened by Augment Code | View session

[augmentcode]

^{PR Author Agent⚡}

👋 I've got this PR.

I'll handle review feedback, CI failures, and merge conflicts, and ping you the moment it's ready for review. Drop a comment anytime.

Marking it ready and picking reviewers are your call — I'll leave both alone.