refactor: consolidate extension system to general-only with manifest-driven architecture

- Remove all sector-specific extensions (construction, ecommerce, export,
  hotel, restaurant, tech) — only general-purpose extensions remain
- Move NE-bilaga and SRU export from extensions to core reports (lib/reports/)
- Move moms-box-mapping from extensions/export/shared to lib/vat/
- Replace per-extension API routes with catch-all dispatcher
  (app/api/extensions/ext/[...path]/route.ts)
- Add manifest.json for each extension with metadata, env vars, and deps
- Add api-routes.ts pattern for extension-defined API endpoints
- Add code generation scripts (generate-extension-registry, create-extension)
- Add extensions.config.json for opt-in extension loading
- Add extensions.schema.json for config validation
- Add email service interface with noop default (lib/email/service.ts)
- Add CI workflow (core-build.yml) to verify core builds with zero extensions
- Add migration 045: expand account_type CHECK for untaxed_reserves
- Update CLAUDE.md with comprehensive extension system documentation
- Update all report engines and bookkeeping services for new imports
- Clean up extensions.schema.json to only list existing extensions

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/api/extensions/ext/[...path]/route.ts

@@ -4,18 +4,47 @@ import { ensureInitialized } from '@/lib/init'
 import { extensionRegistry } from '@/lib/extensions/registry'
 import { createExtensionContext } from '@/lib/extensions/context-factory'
 import { isExtensionEnabled } from '@/lib/extensions/toggle-check'
+import type { ApiRouteDefinition } from '@/lib/extensions/types'
 
 ensureInitialized()
 
+/**
+ * Match a request path against a route pattern.
+ * Supports :param wildcards (e.g., /:id/confirm).
+ * Returns extracted params on match, null on mismatch.
+ */
+function matchPath(
+  pattern: string,
+  requestPath: string
+): Record<string, string> | null {
+  const patternParts = pattern.split('/').filter(Boolean)
+  const requestParts = requestPath.split('/').filter(Boolean)
+
+  if (patternParts.length !== requestParts.length) return null
+
+  const params: Record<string, string> = {}
+
+  for (let i = 0; i < patternParts.length; i++) {
+    if (patternParts[i].startsWith(':')) {
+      params[patternParts[i].slice(1)] = requestParts[i]
+    } else if (patternParts[i] !== requestParts[i]) {
+      return null
+    }
+  }
+
+  return params
+}
+
 /**
  * Catch-all route for extension-declared API routes.
  *
  * URL scheme: /api/extensions/ext/{extensionId}/{...routePath}
- * Example:    /api/extensions/ext/enable-banking/banks → GET /banks
+ * Example:    /api/extensions/ext/receipt-ocr/abc123/confirm → POST /:id/confirm
  *
  * - Looks up the extension in the registry
  * - Checks the extension toggle (disabled → 403)
- * - Matches method + path to registered apiRoutes
+ * - Matches method + path pattern to registered apiRoutes
+ * - Extracts path params and appends them as URL search params
  * - Builds an ExtensionContext and passes it to the handler
  */
 async function handleRequest(
@@ -46,24 +75,51 @@ async function handleRequest(
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
-  // Toggle check — disabled extensions return 403
-  const enabled = await isExtensionEnabled(user.id, 'general', extensionId)
+  // Toggle check — use extension's declared sector, fallback to 'general'
+  const sector = extension.sector || 'general'
+  const enabled = await isExtensionEnabled(user.id, sector, extensionId)
   if (!enabled) {
     return NextResponse.json({ error: 'Extension is disabled' }, { status: 403 })
   }
 
-  // Find matching route
-  const route = extension.apiRoutes.find(
-    (r) => r.method === method && r.path === routePath
-  )
+  // Find matching route (supports :param patterns)
+  let matchedRoute: ApiRouteDefinition | null = null
+  let extractedParams: Record<string, string> = {}
 
-  if (!route) {
+  for (const route of extension.apiRoutes) {
+    if (route.method !== method) continue
+
+    const params = matchPath(route.path, routePath)
+    if (params !== null) {
+      matchedRoute = route
+      extractedParams = params
+      break
+    }
+  }
+
+  if (!matchedRoute) {
     return NextResponse.json({ error: 'Route not found' }, { status: 404 })
   }
 
+  // If path params were extracted, create a new Request with them as search params
+  let handlerRequest = request
+  if (Object.keys(extractedParams).length > 0) {
+    const url = new URL(request.url)
+    for (const [key, value] of Object.entries(extractedParams)) {
+      url.searchParams.set(`_${key}`, value)
+    }
+    handlerRequest = new Request(url.toString(), {
+      method: request.method,
+      headers: request.headers,
+      body: request.body,
+      // @ts-expect-error -- duplex needed for streaming body
+      duplex: 'half',
+    })
+  }
+
   // Build context and dispatch
   const ctx = createExtensionContext(supabase, user.id, extensionId)
-  return route.handler(request, ctx)
+  return matchedRoute.handler(handlerRequest, ctx)
 }
 
 export const GET = handleRequest