feat: production readiness — 3-extension deploy with security hardening and observability

- Strip extensions to enable-banking, ai-categorization, ai-chat only
- Remove push-notifications cron from vercel.json
- Add security headers (HSTS, CSP, X-Frame-Options, Permissions-Policy)
- Add /api/health endpoint for uptime monitoring
- Add env var validation in ensureInitialized()
- Fix SIE4 #IB opening balance records from year-end closing entry
- Replace in-memory ai-chat rate limiter with Supabase-backed distributed rate limiting
- Add Sentry error tracking scaffolding (@sentry/nextjs, instrumentation hook)
- Add AI token usage tracking (migration 047, usage-tracker, wired into both AI extensions)
- Include pending enable-banking and dashboard improvements

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/api/health/route.ts

@@ -0,0 +1,45 @@
+import { createClient } from '@supabase/supabase-js'
+import { NextResponse } from 'next/server'
+
+/**
+ * GET /api/health
+ * Public health check endpoint (no auth required).
+ * Returns DB connectivity status for uptime monitoring.
+ */
+export async function GET() {
+  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL
+  const supabaseServiceKey = process.env.SUPABASE_SERVICE_ROLE_KEY
+
+  if (!supabaseUrl || !supabaseServiceKey) {
+    return NextResponse.json(
+      { status: 'unhealthy', timestamp: new Date().toISOString(), version: '1.0.0', error: 'Missing configuration' },
+      { status: 503 }
+    )
+  }
+
+  try {
+    const supabase = createClient(supabaseUrl, supabaseServiceKey)
+    const { error } = await supabase
+      .from('fiscal_periods')
+      .select('id', { count: 'exact', head: true })
+      .limit(1)
+
+    if (error) {
+      return NextResponse.json(
+        { status: 'unhealthy', timestamp: new Date().toISOString(), version: '1.0.0', error: error.message },
+        { status: 503 }
+      )
+    }
+
+    return NextResponse.json({
+      status: 'healthy',
+      timestamp: new Date().toISOString(),
+      version: '1.0.0',
+    })
+  } catch (err) {
+    return NextResponse.json(
+      { status: 'unhealthy', timestamp: new Date().toISOString(), version: '1.0.0', error: err instanceof Error ? err.message : 'Unknown error' },
+      { status: 503 }
+    )
+  }
+}