Fix/supp ag fb (#1023)

* fix: prevent credit notes from entering payment flow

* fix: persist and display customer personal numbers

* feat: configure automatic invoice reminder days

* fix: issue credit notes through send flow

* chore: add repository agent guidance

* feat(mcp): route tools across user companies

* fix(articles): delete unused register entries

* feat(invoices): improve issued invoice actions

* feat(supplier-invoices): retain uploaded source documents

* docs: record implementation decisions

* feat: enhance customer personal number handling and validation

- Updated CustomerForm to allow personal numbers in the format of "********-1234" for individual customers.
- Added validation to ensure personal numbers are only accepted for individual customers in CreateCustomerSchema.
- Implemented masking and encryption for personal numbers to enhance data protection.
- Introduced new utility functions for masking and encrypting personal numbers.
- Added database migration to enforce unique constraints on credit note relationships and prevent duplicate entries.
- Enhanced error handling and logging for credit note issuance and invoice processing.
- Updated tests to cover new credit note creation guards and personal number handling.

* test: enhance list companies test with supabase query mocks

app/api/settings/__tests__/route.test.ts

@@ -84,6 +84,88 @@ describe('PUT /api/settings', () => {
     expect(body.data.company_name).toBe('New Name')
   })
 
+  it('updates all three reminder thresholds', async () => {
+    enqueueMany([
+      {
+        data: {
+          entity_type: 'aktiebolag',
+          onboarding_complete: true,
+          reminder_days_level_1: 15,
+          reminder_days_level_2: 30,
+          reminder_days_level_3: 45,
+        },
+      },
+      {
+        data: {
+          id: 's1',
+          reminder_days_level_1: 7,
+          reminder_days_level_2: 21,
+          reminder_days_level_3: 35,
+        },
+      },
+    ])
+
+    const request = createMockRequest('/api/settings', {
+      method: 'PUT',
+      body: {
+        reminder_days_level_1: 7,
+        reminder_days_level_2: 21,
+        reminder_days_level_3: 35,
+      },
+    })
+    const response = await PUT(request, { params: Promise.resolve({}) })
+    const { status, body } = await parseJsonResponse<{
+      data: { reminder_days_level_1: number; reminder_days_level_2: number; reminder_days_level_3: number }
+    }>(response)
+
+    expect(status).toBe(200)
+    expect(body.data).toMatchObject({
+      reminder_days_level_1: 7,
+      reminder_days_level_2: 21,
+      reminder_days_level_3: 35,
+    })
+  })
+
+  it('returns 400 when reminder thresholds are not increasing', async () => {
+    enqueue({
+      data: {
+        reminder_days_level_1: 15,
+        reminder_days_level_2: 30,
+        reminder_days_level_3: 45,
+      },
+    })
+
+    const request = createMockRequest('/api/settings', {
+      method: 'PUT',
+      body: {
+        reminder_days_level_1: 30,
+        reminder_days_level_2: 20,
+        reminder_days_level_3: 45,
+      },
+    })
+    const response = await PUT(request, { params: Promise.resolve({}) })
+    const { status } = await parseJsonResponse(response)
+
+    expect(status).toBe(400)
+    expect(supabase.from).toHaveBeenCalledTimes(1)
+  })
+
+  it('returns 404 when the settings row does not exist', async () => {
+    enqueueMany([
+      { data: { onboarding_complete: false } },
+      { data: null, error: { code: 'PGRST116', message: 'No rows returned' } },
+    ])
+
+    const request = createMockRequest('/api/settings', {
+      method: 'PUT',
+      body: { reminder_days_level_1: 10 },
+    })
+    const response = await PUT(request, { params: Promise.resolve({}) })
+    const { status } = await parseJsonResponse(response)
+
+    expect(status).toBe(404)
+  })
+
   it('blocks a vacation-year basis change while open balances exist', async () => {
     enqueueMany([
       { data: { salary_vacation_year_basis: 'calendar', onboarding_complete: true } }, // oldSettings