feat: production readiness — 3-extension deploy with security hardening and observability

- Strip extensions to enable-banking, ai-categorization, ai-chat only
- Remove push-notifications cron from vercel.json
- Add security headers (HSTS, CSP, X-Frame-Options, Permissions-Policy)
- Add /api/health endpoint for uptime monitoring
- Add env var validation in ensureInitialized()
- Fix SIE4 #IB opening balance records from year-end closing entry
- Replace in-memory ai-chat rate limiter with Supabase-backed distributed rate limiting
- Add Sentry error tracking scaffolding (@sentry/nextjs, instrumentation hook)
- Add AI token usage tracking (migration 047, usage-tracker, wired into both AI extensions)
- Include pending enable-banking and dashboard improvements

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lib/init.ts

@@ -2,9 +2,60 @@ import { loadExtensions } from '@/lib/extensions/loader'
 import { setContextFactory } from '@/lib/extensions/registry'
 import { createExtensionContext } from '@/lib/extensions/context-factory'
 import { registerSupplierInvoiceHandler } from '@/lib/bookkeeping/handlers/supplier-invoice-handler'
+import { createLogger } from '@/lib/logger'
+
+const log = createLogger('init')
 
 let initialized = false
 
+const REQUIRED_CORE_VARS = [
+  'NEXT_PUBLIC_SUPABASE_URL',
+  'NEXT_PUBLIC_SUPABASE_ANON_KEY',
+  'SUPABASE_SERVICE_ROLE_KEY',
+  'NEXT_PUBLIC_APP_URL',
+  'CRON_SECRET',
+] as const
+
+const REQUIRED_EXTENSION_VARS = [
+  'ENABLE_BANKING_APP_ID',
+  'ENABLE_BANKING_PRIVATE_KEY',
+  'ANTHROPIC_API_KEY',
+  'OPENAI_API_KEY',
+] as const
+
+const OPTIONAL_VARS = [
+  'SENTRY_DSN',
+  'LANGFUSE_SECRET_KEY',
+  'LANGFUSE_PUBLIC_KEY',
+] as const
+
+function validateEnvironment(): void {
+  const missing: string[] = []
+
+  for (const v of REQUIRED_CORE_VARS) {
+    if (!process.env[v]) missing.push(v)
+  }
+
+  if (missing.length > 0) {
+    throw new Error(`Missing required environment variables: ${missing.join(', ')}`)
+  }
+
+  const missingExt: string[] = []
+  for (const v of REQUIRED_EXTENSION_VARS) {
+    if (!process.env[v]) missingExt.push(v)
+  }
+
+  if (missingExt.length > 0) {
+    throw new Error(`Missing required extension environment variables: ${missingExt.join(', ')}`)
+  }
+
+  for (const v of OPTIONAL_VARS) {
+    if (!process.env[v]) {
+      log.warn(`Optional environment variable ${v} is not set`)
+    }
+  }
+}
+
 /**
  * Ensure the system is initialized (extensions loaded, context factory wired,
  * core event handlers registered).
@@ -15,6 +66,7 @@ export function ensureInitialized(): void {
   if (initialized) return
   initialized = true
 
+  validateEnvironment()
   setContextFactory(createExtensionContext)
   registerSupplierInvoiceHandler()
   loadExtensions()