feat(settings): let a company name each verifikationsserie letter (#2336)

* feat(settings): let a company name each verifikationsserie letter

The series pickers show a fixed preset label next to every letter (A
Redovisning ... M Momsrapport, Fortnox's layout). A byrå that lays its
series out differently sees a wrong or missing name in every dropdown: a
partner running löner on L saw "Kontantfaktura" in the verifikat form and
asked for the series name.

- company_settings.voucher_series_labels JSONB ({"L": "Lön"}), keys A-Z,
  values 1 to 40 chars, CHECK on the JSON shape. Display only; the engine
  never reads it.
- UpdateSettingsSchema validates the map, trims names and strips empty
  values so a cleared field removes the name.
- voucherSeriesLabel(letter, labels) is the one place that decides what a
  letter is called: company name, then preset, then empty.
  buildVoucherSeriesOptions replaces the three near-identical option
  builders in the verifikat form and the two settings pickers.
- The Verifikationsserier list in settings edits the names: rows are the
  union of used, configured and named letters, one save button.
- The SIE import review's two series pickers show the name too.

Migration applied to staging (metjnjrhvujscngnpzdv) as 20260906131300.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QBj3hzDUb8sgtxTvyAjFWC

* fix(settings): keep imported series in the list and unsaved names through a refetch

Skeptic pass on the series-name editor refuted two things:

- The rewritten list filtered voucher_sequences to single letters, dropping
  multi-character series (FT, LB, SKV, ...) that 54 production companies
  carry over from Fortnox and Bokio imports; the old list showed them with
  their highest number. Rows are now every used series plus the configured
  and named letters; only single-letter series get a name input, since
  those are what the pickers offer and the schema accepts.
- The draft re-seeded on the identity of settings.voucher_series_labels,
  and the settings hook revalidates on window focus with a fresh object, so
  unsaved typing was wiped after any earlier save on the page. The re-seed
  is now keyed on the serialized content of the saved names.

Also folds the "new series are created on first use" footnote back into
the group help, which the rewrite had dropped.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QBj3hzDUb8sgtxTvyAjFWC

* fix(settings): name the default-series options and enforce the label shape in the database

Review pass on #2336:

- CodeRabbit: the Standardserie selector under Bokföring still rendered
  bare letters; it now shows the same name the other pickers do, through
  voucherSeriesLabel.
- Compliance swarm (SOC 2 PI1.1, low): the key and length rules for
  voucher_series_labels lived only in UpdateSettingsSchema. Migration
  20260906134700 adds voucher_series_labels_valid(jsonb) and swaps the
  object-only CHECK for one that mirrors the Zod rules (keys A-Z, values
  non-blank strings of at most 40 characters), so a write that bypasses
  /api/settings cannot store a map the pickers cannot handle. Applied to
  staging with its schema_migrations row; verified against good, empty,
  lowercase, blank, over-long, numeric and array inputs.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QBj3hzDUb8sgtxTvyAjFWC

* test(pg): cover the voucher_series_labels CHECK against real Postgres

The coverage gate refuses a migration that adds a function without a
*.pg.test.ts. voucher_series_labels_valid(jsonb) and the constraint that
wraps it now have one: accepts the empty map and single-letter keys with
names of 1 to 40 characters, rejects lowercase and multi-letter keys,
blank, over-long, numeric and null values, arrays and scalars, and leaves
the row untouched after a refused write.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QBj3hzDUb8sgtxTvyAjFWC

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

tests/helpers.ts

@@ -522,6 +522,7 @@ export function makeCompanySettings(
       storno: 'A',
       correction: 'A',
     },
+    voucher_series_labels: {},
     last_supplier_payment_account: null,
     ore_rounding: true,
     invoice_show_ocr: true,

tests/pg/voucher-series-labels.pg.test.ts

@@ -0,0 +1,113 @@
+import { describe, it, expect } from 'vitest'
+import { getPool } from './setup'
+import { seedCompany } from './fixtures'
+
+/**
+ * `company_settings.voucher_series_labels` shape rule (migrations
+ * 20260906131300 and 20260906134700).
+ *
+ * The API route validates the map through UpdateSettingsSchema; this CHECK
+ * is what stops a write that bypasses the route (admin script, backfill,
+ * service-role path) from storing a map the series pickers cannot handle.
+ * Under test: `voucher_series_labels_valid(jsonb)` and the constraint that
+ * wraps it. Superuser pool on purpose: the object is the CHECK, not RLS.
+ */
+
+const CHECK_VIOLATION = '23514'
+
+async function seedSettings(): Promise<string> {
+  const { companyId } = await seedCompany()
+  // A trigger may already have created the row; either way one exists after this.
+  await getPool().query(
+    `INSERT INTO public.company_settings (company_id) VALUES ($1) ON CONFLICT DO NOTHING`,
+    [companyId],
+  )
+  return companyId
+}
+
+async function setLabels(companyId: string, labels: string): Promise<void> {
+  await getPool().query(
+    `UPDATE public.company_settings SET voucher_series_labels = $2::jsonb WHERE company_id = $1`,
+    [companyId, labels],
+  )
+}
+
+async function expectRejected(companyId: string, labels: string): Promise<void> {
+  await expect(setLabels(companyId, labels)).rejects.toMatchObject({ code: CHECK_VIOLATION })
+}
+
+describe('voucher_series_labels_valid', () => {
+  it('accepts the empty map, single-letter keys and names of 1 to 40 characters', async () => {
+    const { rows } = await getPool().query<{ empty: boolean; good: boolean; max: boolean }>(
+      `SELECT public.voucher_series_labels_valid('{}'::jsonb) AS empty,
+              public.voucher_series_labels_valid('{"L":"Lön","N":"Utlägg"}'::jsonb) AS good,
+              public.voucher_series_labels_valid(('{"L":"' || repeat('x', 40) || '"}')::jsonb) AS max`,
+    )
+    expect(rows[0]).toEqual({ empty: true, good: true, max: true })
+  })
+
+  it('rejects every shape the Zod schema rejects', async () => {
+    const { rows } = await getPool().query<Record<string, boolean>>(
+      `SELECT public.voucher_series_labels_valid('{"l":"Lön"}'::jsonb) AS lowercase_key,
+              public.voucher_series_labels_valid('{"AB":"Lön"}'::jsonb) AS two_letter_key,
+              public.voucher_series_labels_valid('{"":"Lön"}'::jsonb) AS empty_key,
+              public.voucher_series_labels_valid('{"L":""}'::jsonb) AS empty_value,
+              public.voucher_series_labels_valid('{"L":"   "}'::jsonb) AS blank_value,
+              public.voucher_series_labels_valid(('{"L":"' || repeat('x', 41) || '"}')::jsonb) AS too_long,
+              public.voucher_series_labels_valid('{"L":7}'::jsonb) AS number_value,
+              public.voucher_series_labels_valid('{"L":null}'::jsonb) AS null_value,
+              public.voucher_series_labels_valid('[]'::jsonb) AS array_map,
+              public.voucher_series_labels_valid('"Lön"'::jsonb) AS scalar`,
+    )
+    expect(Object.values(rows[0]).every((v) => v === false)).toBe(true)
+  })
+})
+
+describe('company_settings.voucher_series_labels CHECK', () => {
+  it('defaults to an empty map and stores a valid map', async () => {
+    const companyId = await seedSettings()
+    const before = await getPool().query<{ voucher_series_labels: unknown }>(
+      `SELECT voucher_series_labels FROM public.company_settings WHERE company_id = $1`,
+      [companyId],
+    )
+    expect(before.rows[0].voucher_series_labels).toEqual({})
+
+    await setLabels(companyId, '{"L":"Lön","N":"Utlägg"}')
+    const after = await getPool().query<{ voucher_series_labels: unknown }>(
+      `SELECT voucher_series_labels FROM public.company_settings WHERE company_id = $1`,
+      [companyId],
+    )
+    expect(after.rows[0].voucher_series_labels).toEqual({ L: 'Lön', N: 'Utlägg' })
+  })
+
+  it('refuses a lowercase or multi-letter key', async () => {
+    const companyId = await seedSettings()
+    await expectRejected(companyId, '{"l":"Lön"}')
+    await expectRejected(companyId, '{"FT":"Fortnox"}')
+  })
+
+  it('refuses a blank, over-long or non-string name', async () => {
+    const companyId = await seedSettings()
+    await expectRejected(companyId, '{"L":""}')
+    await expectRejected(companyId, '{"L":"   "}')
+    await expectRejected(companyId, `{"L":"${'x'.repeat(41)}"}`)
+    await expectRejected(companyId, '{"L":7}')
+  })
+
+  it('refuses anything that is not an object', async () => {
+    const companyId = await seedSettings()
+    await expectRejected(companyId, '[]')
+    await expectRejected(companyId, '"Lön"')
+  })
+
+  it('leaves the row untouched after a refused write', async () => {
+    const companyId = await seedSettings()
+    await setLabels(companyId, '{"L":"Lön"}')
+    await expectRejected(companyId, '{"l":"fel"}')
+    const { rows } = await getPool().query<{ voucher_series_labels: unknown }>(
+      `SELECT voucher_series_labels FROM public.company_settings WHERE company_id = $1`,
+      [companyId],
+    )
+    expect(rows[0].voucher_series_labels).toEqual({ L: 'Lön' })
+  })
+})