feat(transactions): underlag status badges + attach dialog; auto-expire stale pending ops (#712)

* feat(transactions): per-row underlag status + attach-document dialog

- New "Matcha mot underlag" dialog on /transactions (inbox pick or fresh
  upload), the tx→doc mirror of the Documents view's matcher
- Per-row Underlag/Underlag saknas badges on booked history rows, driven
  by computeJeUnderlagStatus — same posted-only, exemption-aware scope as
  the worklist count so badge and count never disagree
- attach-document route + commit dispatcher now propagate the doc onto
  the verifikation when the tx is already booked (BFL 5 kap 6 §), with a
  409 guard for docs consumed by a different verifikation, idempotent
  re-attach (no same-value rewrite under period lock), and an honest 409
  when the period-lock trigger blocks the propagation
- Booking-dialog doc links also pin the doc to the transaction row
  (first linked doc wins) via the link route's new transaction_id param

messages/{sv,en}.json also carries the strings for the pending-ops
expiry UI that lands in the next commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(pending-operations): auto-expire stale staged operations after 30 days

- New daily cron (02:30 UTC, vercel.json + both docker crontabs) flips
  >30-day-old pending ops to rejected with the dispatcher's
  { auto_rejected: true, reason: 'expired' } result_data shape — rows are
  never deleted, the table is the audit trail
- /pending renders an "Utgick automatiskt" badge + detail line for these,
  orders terminal tabs by resolved_at so a fresh expiry sweep isn't
  buried, and adds a first-time-reviewer explainer
- Origin labels spell out where a proposal came from (AI chat, MCP key,
  API, cron) instead of the raw actor_label
- agent_chat actor type added to PendingOperationActorType/AuditLogEntry
  (DB CHECK already widened in 20260519090000) and to the agent filter
- ApprovalCard notes that ignoring a proposal is safe

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(mcp): surface the client telemetry marker in connect instructions

Tag the connector URLs shown in ApiKeysPanel, the connect-claude doc and
the gnubok-mcp README with ?client=<surface> (claude-connector /
claude-code) and GNUBOK_CLIENT=claude-desktop for the npm bridge.
Telemetry-only — the server already reads the param/header; this just
lets us measure which Claude surface connected.

The claude mcp add copy blocks quote the URL: an unquoted ? in the query
string trips zsh globbing ("no matches found").

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* review: fix stale-closure badge flip + zod-validate link route body (PR #712)

- handleDocumentAttached read journal_entry_id off the render-time
  transactions snapshot; if the list changed while the attach dialog was
  open the optimistic badge flip was silently skipped. Read it off the
  dialog's own subject (attachDocTx) instead.
- POST /api/documents/[id]/link now validates the body against the new
  LinkDocumentSchema (uuid-strict, all four fields) instead of a bare
  presence check on journal_entry_id — same canonical VALIDATION_ERROR
  envelope. Test fixtures switched to real UUIDs accordingly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

components/settings/ApiKeysPanel.tsx

@@ -360,9 +360,12 @@ export function ApiKeysPanel() {
     })
   }
 
-  const mcpUrl = typeof window !== 'undefined'
+  const mcpBase = typeof window !== 'undefined'
     ? `${window.location.origin}/api/extensions/ext/mcp-server/mcp`
     : '/api/extensions/ext/mcp-server/mcp'
+  // Telemetry-only distribution-channel marker (server reads the `client` query
+  // param; never used for auth). Lets us measure which Claude surface connected.
+  const mcpUrl = (client: string) => `${mcpBase}?client=${client}`
 
   return (
     <div className="space-y-6">
@@ -465,7 +468,7 @@ export function ApiKeysPanel() {
                 path: (chunks) => <strong>{chunks}</strong>,
               })}
             </p>
-            <CopyBlock text={mcpUrl} copyAriaLabel={t('copy_aria')} />
+            <CopyBlock text={mcpUrl('claude-connector')} copyAriaLabel={t('copy_aria')} />
           </div>
 
           <div>
@@ -473,7 +476,8 @@ export function ApiKeysPanel() {
             <p className="text-xs text-muted-foreground mb-2">
               {t('terminal_runs_browser_login')}
             </p>
-            <CopyBlock text={`claude mcp add ${connectorName} --transport http ${mcpUrl}`} copyAriaLabel={t('copy_aria')} />
+            {/* URL is quoted — unquoted `?` in the query string trips zsh globbing. */}
+            <CopyBlock text={`claude mcp add ${connectorName} --transport http "${mcpUrl('claude-code')}"`} copyAriaLabel={t('copy_aria')} />
           </div>
 
           <div className="border-t pt-4">
@@ -500,7 +504,8 @@ export function ApiKeysPanel() {
       "command": "npx",
       "args": ["gnubok-mcp"],
       "env": {
-        "GNUBOK_API_KEY": "gnubok_sk_..."
+        "GNUBOK_API_KEY": "gnubok_sk_...",
+        "GNUBOK_CLIENT": "claude-desktop"
       }
     }
   }
@@ -513,7 +518,7 @@ export function ApiKeysPanel() {
                     {t('terminal_with_api_key')}
                   </p>
                   <CopyBlock text={`claude mcp add ${connectorName} --transport http \\
-  --url ${mcpUrl} \\
+  --url "${mcpUrl('claude-code')}" \\
   --header "Authorization: Bearer gnubok_sk_..."`} copyAriaLabel={t('copy_aria')} />
                 </div>
               </div>