Fix/supp ag fb (#1023)

* fix: prevent credit notes from entering payment flow

* fix: persist and display customer personal numbers

* feat: configure automatic invoice reminder days

* fix: issue credit notes through send flow

* chore: add repository agent guidance

* feat(mcp): route tools across user companies

* fix(articles): delete unused register entries

* feat(invoices): improve issued invoice actions

* feat(supplier-invoices): retain uploaded source documents

* docs: record implementation decisions

* feat: enhance customer personal number handling and validation

- Updated CustomerForm to allow personal numbers in the format of "********-1234" for individual customers.
- Added validation to ensure personal numbers are only accepted for individual customers in CreateCustomerSchema.
- Implemented masking and encryption for personal numbers to enhance data protection.
- Introduced new utility functions for masking and encrypting personal numbers.
- Added database migration to enforce unique constraints on credit note relationships and prevent duplicate entries.
- Enhanced error handling and logging for credit note issuance and invoice processing.
- Updated tests to cover new credit note creation guards and personal number handling.

* test: enhance list companies test with supabase query mocks

app/api/settings/route.ts

@@ -40,7 +40,7 @@ export const PUT = withRouteContext(
     // Fetch current settings to check for tax-relevant changes
     const { data: oldSettings } = await supabase
       .from('company_settings')
-      .select('entity_type, moms_period, f_skatt, vat_registered, vat_number, pays_salaries, fiscal_year_start_month, onboarding_complete, salary_vacation_year_basis')
+      .select('entity_type, moms_period, f_skatt, vat_registered, vat_number, pays_salaries, fiscal_year_start_month, onboarding_complete, salary_vacation_year_basis, reminder_days_level_1, reminder_days_level_2, reminder_days_level_3')
       .eq('company_id', companyId)
       .single()
 
@@ -48,6 +48,18 @@ export const PUT = withRouteContext(
     if (!validation.success) return validation.response
     const body = validation.data
 
+    const reminderDays = [
+      body.reminder_days_level_1 ?? oldSettings?.reminder_days_level_1 ?? 15,
+      body.reminder_days_level_2 ?? oldSettings?.reminder_days_level_2 ?? 30,
+      body.reminder_days_level_3 ?? oldSettings?.reminder_days_level_3 ?? 45,
+    ]
+    if (!(reminderDays[0] < reminderDays[1] && reminderDays[1] < reminderDays[2])) {
+      return NextResponse.json(
+        { error: 'Påminnelsedagarna måste ligga i stigande ordning.' },
+        { status: 400 },
+      )
+    }
+
     // Lock org_number after onboarding is complete (legal identifier: changing it
     // would orphan vouchers, SIE history, and tax filings). company_name remains
     // editable so users can update their display/brand name (e.g. särskilt företagsnamn).
@@ -121,6 +133,9 @@ export const PUT = withRouteContext(
       .single()
 
     if (error) {
+      if (error.code === 'PGRST116') {
+        return NextResponse.json({ error: 'Inställningarna hittades inte.' }, { status: 404 })
+      }
       return NextResponse.json({ error: error.message }, { status: 500 })
     }