feat: production readiness — 3-extension deploy with security hardening and observability

- Strip extensions to enable-banking, ai-categorization, ai-chat only
- Remove push-notifications cron from vercel.json
- Add security headers (HSTS, CSP, X-Frame-Options, Permissions-Policy)
- Add /api/health endpoint for uptime monitoring
- Add env var validation in ensureInitialized()
- Fix SIE4 #IB opening balance records from year-end closing entry
- Replace in-memory ai-chat rate limiter with Supabase-backed distributed rate limiting
- Add Sentry error tracking scaffolding (@sentry/nextjs, instrumentation hook)
- Add AI token usage tracking (migration 047, usage-tracker, wired into both AI extensions)
- Include pending enable-banking and dashboard improvements

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

extensions/general/ai-chat/chatbot/chain.ts

@@ -17,6 +17,7 @@ import { streamAgentResponse, type ToolResultEntry } from './agent'
 import { generateArtifact, type ArtifactSpec } from './artifacts'
 import type { ChatMessage, SourceReference } from '@/types/chat'
 import type { SupabaseClient } from '@supabase/supabase-js'
+import { trackTokenUsage } from '@/lib/ai/usage-tracker'
 
 // Initialize the LLM
 function getChatModel() {
@@ -35,7 +36,8 @@ export interface ChatResult {
 
 export async function generateChatResponse(
   userMessage: string,
-  conversationHistory: ChatMessage[]
+  conversationHistory: ChatMessage[],
+  tracking?: { supabase: SupabaseClient; userId: string }
 ): Promise<ChatResult> {
   // 1. Retrieve relevant documents
   const relevantDocs = await retrieveRelevantDocuments(userMessage)
@@ -74,7 +76,16 @@ export async function generateChatResponse(
     new HumanMessage(userMessage),
   ])
 
-  // 6. Extract content and sources
+  // 6. Track token usage
+  if (tracking && response.usage_metadata) {
+    trackTokenUsage(tracking.supabase, tracking.userId, 'ai-chat', {
+      inputTokens: response.usage_metadata.input_tokens ?? 0,
+      outputTokens: response.usage_metadata.output_tokens ?? 0,
+      model: CHATBOT_CONFIG.model,
+    })
+  }
+
+  // 7. Extract content and sources
   const content =
     typeof response.content === 'string'
       ? response.content