Add/customer mcp (#1055)

* feat(mcp): kontoplan account tools + verifikat notes exposure

Two gaps reported by an MCP-driven user: no account management in the
API, and verifikat notes invisible to agents (they exist in the product
but MCP could neither read nor write them).

- add staged gnubok_create_account / gnubok_update_account (BAS 2026
  prefill for catalog numbers; rename/VAT-default/SRU/activate via
  update; both LOW risk reference data)
- add staged gnubok_set_voucher_note (notes-only annotation, legal on
  posted entries per the 20260608120000 trigger carve-out) and return
  entry_notes from gnubok_query_journal
- new pending_operations types create_account / update_account /
  set_voucher_note (CHECK migration + validate companion, applied to
  staging)
- tools/list payload ceiling 54K -> 56K (documented; wire contract,
  descriptions trimmed first)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(skatteverket): unstick BankID connect flow and stale connection views

- respond to the OAuth callback immediately and run the post-connect
  refresh after the response (next/server after()): users no longer
  stare at Skatteverket's consumed consent page for up to 40s
- open the consent flow in a full tab instead of a 600x750 popup that
  hid the approve button below the fold
- disable connect buttons while the OAuth tab is open (parallel flows
  overwrote oauth_state + the PKCE verifier) and recover via a
  closed-tab watcher plus a delayed status refetch
- persist MISSING_SCOPE token health from the post-connect sync and
  show an actionable "approve all permissions" notice
- refetch connection state on tab visibility (settings connect panel,
  enable-banking panel, /skattekonto) so a connect completed in another
  tab or after a mobile app-switch shows up without a manual reload;
  fix /skattekonto never clearing its not-connected state

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(article-form): add article number field with validation to ArticleForm

* feat(account): enforce account type consistency with BAS class and add validation

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

extensions/general/enable-banking/components/BankingSettingsPanel.tsx

@@ -62,6 +62,34 @@ export default function BankingSettingsPanel() {
     }
   }, [])
 
+  // Latest-ref so the visibility listener below (subscribed once) always
+  // calls the current render's fetchConnections, which closes over company
+  // context that may resolve after mount.
+  const fetchConnectionsRef = useRef(fetchConnections)
+  useEffect(() => {
+    fetchConnectionsRef.current = fetchConnections
+  })
+
+  // Safety net for completion signals that never reach this tab: a mobile
+  // BankID app-switch can land the bank's redirect in a different browser
+  // tab, the user can close the finalize page before its redirect, and a
+  // bfcache-restored page shows a pre-connection snapshot. Refetch when the
+  // tab regains visibility (background refresh, no spinner: fetchConnections
+  // only blanks the panel on first load), throttled so rapid tab toggling
+  // doesn't hammer the API.
+  const lastVisibilityFetchRef = useRef(0)
+  useEffect(() => {
+    function onVisible() {
+      if (document.visibilityState !== 'visible') return
+      const now = Date.now()
+      if (now - lastVisibilityFetchRef.current < 5_000) return
+      lastVisibilityFetchRef.current = now
+      void fetchConnectionsRef.current()
+    }
+    document.addEventListener('visibilitychange', onVisible)
+    return () => document.removeEventListener('visibilitychange', onVisible)
+  }, [])
+
   // Auto-open the picker when the user lands here from the OAuth callback
   // (URL: /settings/banking?select_accounts=<id>). The query param is stripped
   // afterwards so a refresh doesn't keep reopening it.