feat(transactions): underlag status badges + attach dialog; auto-expire stale pending ops (#712)

* feat(transactions): per-row underlag status + attach-document dialog

- New "Matcha mot underlag" dialog on /transactions (inbox pick or fresh
  upload), the tx→doc mirror of the Documents view's matcher
- Per-row Underlag/Underlag saknas badges on booked history rows, driven
  by computeJeUnderlagStatus — same posted-only, exemption-aware scope as
  the worklist count so badge and count never disagree
- attach-document route + commit dispatcher now propagate the doc onto
  the verifikation when the tx is already booked (BFL 5 kap 6 §), with a
  409 guard for docs consumed by a different verifikation, idempotent
  re-attach (no same-value rewrite under period lock), and an honest 409
  when the period-lock trigger blocks the propagation
- Booking-dialog doc links also pin the doc to the transaction row
  (first linked doc wins) via the link route's new transaction_id param

messages/{sv,en}.json also carries the strings for the pending-ops
expiry UI that lands in the next commit.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(pending-operations): auto-expire stale staged operations after 30 days

- New daily cron (02:30 UTC, vercel.json + both docker crontabs) flips
  >30-day-old pending ops to rejected with the dispatcher's
  { auto_rejected: true, reason: 'expired' } result_data shape — rows are
  never deleted, the table is the audit trail
- /pending renders an "Utgick automatiskt" badge + detail line for these,
  orders terminal tabs by resolved_at so a fresh expiry sweep isn't
  buried, and adds a first-time-reviewer explainer
- Origin labels spell out where a proposal came from (AI chat, MCP key,
  API, cron) instead of the raw actor_label
- agent_chat actor type added to PendingOperationActorType/AuditLogEntry
  (DB CHECK already widened in 20260519090000) and to the agent filter
- ApprovalCard notes that ignoring a proposal is safe

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(mcp): surface the client telemetry marker in connect instructions

Tag the connector URLs shown in ApiKeysPanel, the connect-claude doc and
the gnubok-mcp README with ?client=<surface> (claude-connector /
claude-code) and GNUBOK_CLIENT=claude-desktop for the npm bridge.
Telemetry-only — the server already reads the param/header; this just
lets us measure which Claude surface connected.

The claude mcp add copy blocks quote the URL: an unquoted ? in the query
string trips zsh globbing ("no matches found").

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* review: fix stale-closure badge flip + zod-validate link route body (PR #712)

- handleDocumentAttached read journal_entry_id off the render-time
  transactions snapshot; if the list changed while the attach dialog was
  open the optimistic badge flip was silently skipped. Read it off the
  dialog's own subject (attachDocTx) instead.
- POST /api/documents/[id]/link now validates the body against the new
  LinkDocumentSchema (uuid-strict, all four fields) instead of a bare
  presence check on journal_entry_id — same canonical VALIDATION_ERROR
  envelope. Test fixtures switched to real UUIDs accordingly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/pending-operations/commit.ts

@@ -1453,12 +1453,25 @@ async function commitAttachDocumentToTransaction(
 
   const { data: doc, error: docError } = await supabase
     .from('document_attachments')
-    .select('id')
+    .select('id, journal_entry_id')
     .eq('id', documentId)
     .eq('company_id', companyId)
     .maybeSingle()
   if (docError || !doc) return { error: 'Document not found', status: 404 }
 
+  // A document that already serves as underlag for a DIFFERENT verifikation
+  // cannot be pinned here — propagating would either corrupt that link or be
+  // blocked by the document-metadata immutability trigger. Same verifikation
+  // is fine (idempotent re-attach; propagation below becomes a no-op).
+  // Mirrors the REST route in app/api/transactions/[id]/attach-document.
+  const docJournalEntryId = (doc.journal_entry_id as string | null) ?? null
+  if (docJournalEntryId && docJournalEntryId !== tx.journal_entry_id) {
+    return {
+      error: 'Underlaget är redan kopplat till en annan verifikation.',
+      status: 409,
+    }
+  }
+
   // Race-free read of journal_entry_id: use UPDATE ... RETURNING so the value
   // we propagate against reflects any concurrent categorize that committed
   // before our UPDATE acquired the row lock. Reading the post-update state
@@ -1511,13 +1524,29 @@ async function commitAttachDocumentToTransaction(
   }
 
   const journalEntryId = postUpdate.journal_entry_id as string | null
-  if (journalEntryId) {
+  // Skip when the doc already points at this verifikation: the period-lock
+  // trigger raises on ANY journal_entry_id write (even a same-value rewrite),
+  // so an unconditional re-run would 500 an otherwise idempotent re-attach
+  // once the period locks.
+  if (journalEntryId && docJournalEntryId !== journalEntryId) {
     const { error: linkErr } = await supabase
       .from('document_attachments')
       .update({ journal_entry_id: journalEntryId })
       .eq('id', documentId)
       .eq('company_id', companyId)
     if (linkErr) {
+      // The enforce_period_lock trigger blocks journal_entry_id writes when
+      // the target entry sits in a closed/locked period. Map to 409 — the
+      // dispatcher auto-rejects it, and a retry could never succeed until the
+      // period is unlocked, so "försök igen" would be a false promise.
+      const linkMsg = (linkErr as { message?: string }).message ?? ''
+      if (/locked\/closed fiscal period|Bokföringen är låst/i.test(linkMsg)) {
+        return {
+          error:
+            'Bilagan kopplades till transaktionen men verifikationens period är låst — den kunde inte länkas till verifikationen.',
+          status: 409,
+        }
+      }
       // Surface the propagation failure rather than logging-and-continuing.
       // BFL 5 kap 6 § requires the verifikation to reference its underlag, so
       // a "succeeded" attach that left document_attachments.journal_entry_id