feat(peppol): Qvalia access-point adapter, send flow and delivery webhook (#1780)

* feat(peppol): Qvalia access-point adapter, send flow and delivery webhook

Qvalia is the contracted Peppol Access Point (signed 2026-08-21). This fills
the provider-neutral PeppolTransport seam from #1595 with a real adapter and
turns the disabled "Skicka via Peppol" menu item into a working send flow.

Adapter (lib/invoices/transports/qvalia.ts): partner-scoped recipient lookup,
XML submission to /invoices/outgoing with integrationId correlation, 409
recovery only when the stored copy carries the same seller endpoint, tolerant
mapping of Qvalia's free-text webhook statuses onto the 11-state lifecycle,
constant-time shared-secret webhook verification (Qvalia does not sign
webhooks), and evidence retrieval of the message-log status plus Qvalia's
stored XML copy. Registered from the environment in lib/init.ts; switched on
per deployment with PEPPOL_TRANSPORT_PROVIDER=qvalia.

POST /api/invoices/[id]/peppol/send: stage the exact XML, look up the
recipient, record recipient_verified and submitting, submit, record
submission_accepted, then issue a draft with the mark-sent semantics
(issueAndBookInvoice) only after the network accepted it. A sync rejection is
a terminal failed event so the identical document is never re-sent; an
operational failure is retryable; an already-submitted XML replays
idempotently.

POST /api/webhooks/peppol/qvalia resolves the delivery by integrationId,
persists the verified event via the service-role RPC and stores evidence
best-effort; unknown submissions answer 200, our own persistence failures 500.

UI: the send item is availability-driven with a confirm dialog, the invoice
page shows the latest Peppol status, and drafts can be sent (the number is
assigned server-side). Probe script for the first sandbox contact under
scripts/peppol/qvalia-probe.ts.

Refs #546

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TqFpxeWqbpR7bcwUJLRERQ

* fix(peppol): Qvalia sandbox facts from first live contact: bare-key auth, api-test host, SMP-URL document types

The onboarding mail and a live probe against the sandbox (partner
SE5595386219) corrected three assumptions from the public docs: the key is
accepted bare in the Authorization header (the ApiKey prefix answers 401), the
sandbox host is api-test.qvalia.com, and the recipient lookup returns document
types as SMP service URLs, so capabilities are now normalized to bare Peppol
document type ids before comparison.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TqFpxeWqbpR7bcwUJLRERQ

* feat(peppol): probe commands to inspect and configure the Qvalia webhook subscription

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TqFpxeWqbpR7bcwUJLRERQ

* fix(peppol): decode UBL entities in one pass (CodeQL js/double-escaping)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TqFpxeWqbpR7bcwUJLRERQ

---------

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

.env.example

@@ -104,6 +104,25 @@ RECEIPT_HUNT_COMPANY_IDS=
 # Bank connections (Enable Banking)
 # ENABLE_BANKING_APP_ID=
 # ENABLE_BANKING_PRIVATE_KEY=
+# Peppol e-invoicing via Qvalia (certified Access Point + SMP, partner model).
+# The adapter registers itself when QVALIA_API_KEY, QVALIA_PARTNER_REG_NO and
+# QVALIA_BASE_URL are all set; PEPPOL_TRANSPORT_PROVIDER=qvalia switches it on
+# for users. Sandbox https://api-test.qvalia.com, production https://api.qvalia.com,
+# separate keys per environment. QVALIA_ACCOUNT_REG_NO defaults to the partner
+# number (consolidated setup). QVALIA_WEBHOOK_SECRET is the value Qvalia echoes
+# in the QVALIA_WEBHOOK_HEADER on every delivery event (configure it with
+# POST /partner/{p}/webhook/{id}/auth, type api_key). The key is sent bare in
+# the Authorization header (what the sandbox accepts); QVALIA_AUTH_SCHEME=apikey
+# switches to the "ApiKey <key>" form from the newest docs.
+# PEPPOL_TRANSPORT_PROVIDER=qvalia
+# QVALIA_API_KEY=
+# QVALIA_PARTNER_REG_NO=
+# QVALIA_ACCOUNT_REG_NO=
+# QVALIA_BASE_URL=https://api-test.qvalia.com
+# QVALIA_WEBHOOK_SECRET=
+# QVALIA_WEBHOOK_HEADER=x-accounted-webhook-key
+# QVALIA_AUTH_SCHEME=raw
+
 # Accounting integrations
 # FORTNOX_CLIENT_ID=
 # FORTNOX_CLIENT_SECRET=