feat: production readiness — 3-extension deploy with security hardening and observability

- Strip extensions to enable-banking, ai-categorization, ai-chat only
- Remove push-notifications cron from vercel.json
- Add security headers (HSTS, CSP, X-Frame-Options, Permissions-Policy)
- Add /api/health endpoint for uptime monitoring
- Add env var validation in ensureInitialized()
- Fix SIE4 #IB opening balance records from year-end closing entry
- Replace in-memory ai-chat rate limiter with Supabase-backed distributed rate limiting
- Add Sentry error tracking scaffolding (@sentry/nextjs, instrumentation hook)
- Add AI token usage tracking (migration 047, usage-tracker, wired into both AI extensions)
- Include pending enable-banking and dashboard improvements

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lib/reports/sie-export.ts

@@ -116,8 +116,21 @@ export async function generateSIEExport(
   }
 
   // === Opening balances (IB) ===
-  // For now, all zeros unless we have data from previous periods
-  // #IB 0 accountNumber amount
+  if (period.opening_balance_entry_id) {
+    const { data: obEntry } = await supabase
+      .from('journal_entries')
+      .select('*, lines:journal_entry_lines(*)')
+      .eq('id', period.opening_balance_entry_id)
+      .eq('user_id', userId)
+      .single()
+
+    if (obEntry?.lines) {
+      for (const line of (obEntry.lines as JournalEntryLine[])) {
+        const amount = (Number(line.debit_amount) || 0) - (Number(line.credit_amount) || 0)
+        lines.push(`#IB 0 ${line.account_number} ${formatAmount(amount)}`)
+      }
+    }
+  }
 
   // === Journal entries (VER + TRANS) ===
   for (const entry of (entries as JournalEntry[]) || []) {