fix(entitlements): gate the AI-only invoice-inbox for non-payers (#924)

The Dokumentinkorg (invoice-inbox) leaked past the paywall: visible in the
sidebar, command palette, and home "Att gora" list, its page directly
reachable, and every non-AI HTTP route open. Its whole value is AI field
extraction (Claude Sonnet 4.6 via Bedrock), already the paid chokepoint
elsewhere, so gate the whole surface on CAPABILITY.ai.

- EXTENSION_REQUIRED_CAPABILITY map + resolvers (keys.ts, sectors.ts) as the
  single source the nav item, the page, and the API dispatcher all read.
- Hide the sidebar item, command-palette entry, and home inbox row for
  non-payers; subtract inbox_document from the "Att gora" total via one shared
  visibleWorklistTotal helper (KPI tile + header cannot drift), clamped to >= 0.
- Block the /e/[sector]/[slug] page (fail-closed) with an upsell EmptyState.
- Enforce the capability in the extension API dispatcher (the single chokepoint
  that already enforces MFA), so every company-context inbox route 403s. The
  skipAuth /inbound webhook stays open (freeze-and-retain).
- FORCE_PAYWALL=true override so the real gate is exercisable in local dev.
- Tests: gating resolver, FORCE_PAYWALL, dispatcher 403/allow/webhook-exempt,
  visibleWorklistTotal, and enable-banking /connect + /sync 403.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

app/api/extensions/ext/[...path]/route.ts

@@ -4,6 +4,8 @@ import { ensureInitialized } from '@/lib/init'
 import { extensionRegistry } from '@/lib/extensions/registry'
 import { createExtensionContext } from '@/lib/extensions/context-factory'
 import { requireCompanyId } from '@/lib/company/context'
+import { requireCapability } from '@/lib/entitlements/has-capability'
+import { requiredCapabilityForExtensionId } from '@/lib/extensions/sectors'
 import { createLogger } from '@/lib/logger'
 import type { ApiRouteDefinition } from '@/lib/extensions/types'
 
@@ -276,6 +278,23 @@ async function handleRequest(
 
   const companyId = await requireCompanyId(supabase, user.id)
 
+  // Paywall: this dispatcher is the single chokepoint for the whole enabled-
+  // extension API surface (same reasoning as the MFA gate above), so an
+  // extension whose workspace is a paid service (EXTENSION_REQUIRED_CAPABILITY,
+  // e.g. the AI-only invoice-inbox) gates EVERY one of its company-context routes
+  // here, not just its AI-extraction steps. Mirrors the sidebar/page gate off the
+  // same map. The skipAuth ingestion webhook (/inbound) returned above is exempt
+  // by construction: a lapsed company's inbound documents must still be stored
+  // (freeze-and-retain), and booked documents stay reachable via the verifikat.
+  const requiredCapability = requiredCapabilityForExtensionId(extensionId)
+  if (requiredCapability) {
+    const blocked = await requireCapability(supabase, companyId, requiredCapability)
+    if (blocked) {
+      log.info('extension call blocked: capability required', { capability: requiredCapability })
+      return decorateResponse(blocked, requestId)
+    }
+  }
+
   // Build context and dispatch
   const ctx = createExtensionContext(supabase, user.id, companyId, extensionId, requestId)
   const response = await matchedRoute.handler(handlerRequest, ctx)