feat: production readiness — 3-extension deploy with security hardening and observability

- Strip extensions to enable-banking, ai-categorization, ai-chat only
- Remove push-notifications cron from vercel.json
- Add security headers (HSTS, CSP, X-Frame-Options, Permissions-Policy)
- Add /api/health endpoint for uptime monitoring
- Add env var validation in ensureInitialized()
- Fix SIE4 #IB opening balance records from year-end closing entry
- Replace in-memory ai-chat rate limiter with Supabase-backed distributed rate limiting
- Add Sentry error tracking scaffolding (@sentry/nextjs, instrumentation hook)
- Add AI token usage tracking (migration 047, usage-tracker, wired into both AI extensions)
- Include pending enable-banking and dashboard improvements

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lib/extensions/_generated/workspace-map.tsx

@@ -4,11 +4,7 @@ import type { ComponentType } from 'react'
 import type { WorkspaceComponentProps } from '../workspace-registry'
 
 export const WORKSPACES: Record<string, ComponentType<WorkspaceComponentProps>> = {
-  'general/receipt-ocr': dynamic(() => import('@/components/extensions/general/ReceiptOcrWorkspace')),
+  'general/enable-banking': dynamic(() => import('@/components/extensions/general/EnableBankingWorkspace')),
   'general/ai-categorization': dynamic(() => import('@/components/extensions/general/AiCategorizationWorkspace')),
   'general/ai-chat': dynamic(() => import('@/components/extensions/general/AiChatWorkspace')),
-  'general/push-notifications': dynamic(() => import('@/components/extensions/general/PushNotificationsWorkspace')),
-  'general/invoice-inbox': dynamic(() => import('@/components/extensions/general/DocumentInboxWorkspace')),
-  'general/calendar': dynamic(() => import('@/components/extensions/general/CalendarWorkspace')),
-  'general/enable-banking': dynamic(() => import('@/components/extensions/general/EnableBankingWorkspace')),
 }