feat: production readiness — 3-extension deploy with security hardening and observability

- Strip extensions to enable-banking, ai-categorization, ai-chat only
- Remove push-notifications cron from vercel.json
- Add security headers (HSTS, CSP, X-Frame-Options, Permissions-Policy)
- Add /api/health endpoint for uptime monitoring
- Add env var validation in ensureInitialized()
- Fix SIE4 #IB opening balance records from year-end closing entry
- Replace in-memory ai-chat rate limiter with Supabase-backed distributed rate limiting
- Add Sentry error tracking scaffolding (@sentry/nextjs, instrumentation hook)
- Add AI token usage tracking (migration 047, usage-tracker, wired into both AI extensions)
- Include pending enable-banking and dashboard improvements

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

vercel.json

@@ -8,10 +8,6 @@
       "path": "/api/invoices/reminders/cron",
       "schedule": "0 8 * * *"
     },
-    {
-      "path": "/api/extensions/push-notifications/cron",
-      "schedule": "0 9 * * *"
-    },
     {
       "path": "/api/tax-deadlines/cron",
       "schedule": "0 0 2 1 *"