fix: persist submitted documents and clear remaining lint findings

[av-dev2]

Follow-up to #130, which merged before these three commits landed.

Submitted documents were never linked

purchase_invoice, journal_entry and stock_entry were assigned on self
inside on_submit. Frappe has already written the row by then, so the
assignments were discarded and the link fields stayed empty in the database.

They now go through db_set. Records submitted before this change keep their
empty fields.

Lint

int(round(...)) dropped; round() with one argument already returns an int.

Semgrep waivers

Four findings reviewed and waived, each with the rule name and a reason in the
code.

Rule	Why it is waived
frappe-ssti	template path is a hardcoded literal in this app, and the template has no include, import or extends. Only context values vary.
override-doctype-class	ReportOverride subclasses frappe own Report; this is the documented hook.
frappe-codeinjection-eval	Script Report python needs real imports, so safe_exec is not usable. Editing a Report is restricted to System Manager.
frappe-breaks-multitenancy	query builder tables built at import in one report file. Only misbehaves on a bench mixing MariaDB and Postgres sites.

The frappe-codeinjection-eval waiver documents the risk rather than removing
it. If Report write access is ever widened beyond System Manager, revisit it.

pre-commit run --all-files passes on this branch.

[github-actions]

Backport failed for version-16-hotfix, because it was unable to cherry-pick the commit(s).

Please cherry-pick the changes locally and resolve any conflicts.

git fetch origin version-16-hotfix
git worktree add -d .worktree/backport-131-to-version-16-hotfix origin/version-16-hotfix
cd .worktree/backport-131-to-version-16-hotfix
git switch --create backport-131-to-version-16-hotfix
git cherry-pick -x 12ed2cb78496b141907e50a815d34fd2630f007e b7272fba5539f9894a6c781642727ae997a45124 0cef17ef7bf5d3b96b01d8d04ffc9dcb5590fb8d