feat: production readiness — 3-extension deploy with security hardening and observability

- Strip extensions to enable-banking, ai-categorization, ai-chat only
- Remove push-notifications cron from vercel.json
- Add security headers (HSTS, CSP, X-Frame-Options, Permissions-Policy)
- Add /api/health endpoint for uptime monitoring
- Add env var validation in ensureInitialized()
- Fix SIE4 #IB opening balance records from year-end closing entry
- Replace in-memory ai-chat rate limiter with Supabase-backed distributed rate limiting
- Add Sentry error tracking scaffolding (@sentry/nextjs, instrumentation hook)
- Add AI token usage tracking (migration 047, usage-tracker, wired into both AI extensions)
- Include pending enable-banking and dashboard improvements

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lib/extensions/_generated/extension-list.ts

@@ -1,21 +1,11 @@
 // AUTO-GENERATED — do not edit. Run `npm run setup:extensions` to regenerate.
 import type { Extension } from '../types'
-import { receiptOcrExtension } from '@/extensions/general/receipt-ocr'
+import { enableBankingExtension } from '@/extensions/general/enable-banking'
 import { aiCategorizationExtension } from '@/extensions/general/ai-categorization'
 import { aiChatExtension } from '@/extensions/general/ai-chat'
-import { pushNotificationsExtension } from '@/extensions/general/push-notifications'
-import { invoiceInboxExtension } from '@/extensions/general/invoice-inbox'
-import { calendarExtension } from '@/extensions/general/calendar'
-import { enableBankingExtension } from '@/extensions/general/enable-banking'
-import { emailExtension } from '@/extensions/general/email'
 
 export const FIRST_PARTY_EXTENSIONS: Extension[] = [
-  receiptOcrExtension,
+  enableBankingExtension,
   aiCategorizationExtension,
   aiChatExtension,
-  pushNotificationsExtension,
-  invoiceInboxExtension,
-  calendarExtension,
-  enableBankingExtension,
-  emailExtension,
 ]