feat: production readiness — 3-extension deploy with security hardening and observability

- Strip extensions to enable-banking, ai-categorization, ai-chat only
- Remove push-notifications cron from vercel.json
- Add security headers (HSTS, CSP, X-Frame-Options, Permissions-Policy)
- Add /api/health endpoint for uptime monitoring
- Add env var validation in ensureInitialized()
- Fix SIE4 #IB opening balance records from year-end closing entry
- Replace in-memory ai-chat rate limiter with Supabase-backed distributed rate limiting
- Add Sentry error tracking scaffolding (@sentry/nextjs, instrumentation hook)
- Add AI token usage tracking (migration 047, usage-tracker, wired into both AI extensions)
- Include pending enable-banking and dashboard improvements

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

extensions/general/ai-categorization/index.ts

@@ -10,6 +10,7 @@ import {
   type CategorizationSuggestion,
   type AccountUsageEntry,
   type MerchantHistoryEntry,
+  type TrackingContext,
 } from './categorizer'
 import type { BookingTemplate } from '@/lib/bookkeeping/booking-templates'
 
@@ -124,7 +125,7 @@ export async function categorizeTransactions(
   const context = await buildEnrichedContext(userId, supabase, batch)
 
   const aiProvider = getProvider(settings.providerModel)
-  const suggestions = await aiProvider.categorize(batch, context)
+  const suggestions = await aiProvider.categorize(batch, context, { supabase, userId })
 
   // Store suggestions
   await storeSuggestions(userId, suggestions, supabase)
@@ -174,7 +175,7 @@ async function handleTransactionSynced(
 
     const context = await buildEnrichedContext(userId, supabase, batch)
     const aiProvider = getProvider(settings.providerModel)
-    const suggestions = await aiProvider.categorize(batch, context)
+    const suggestions = await aiProvider.categorize(batch, context, { supabase, userId })
 
     // Store only suggestions above confidence threshold
     const qualifiedSuggestions = suggestions.filter(