fix(entitlements): gate the AI-only invoice-inbox for non-payers (#924)

The Dokumentinkorg (invoice-inbox) leaked past the paywall: visible in the
sidebar, command palette, and home "Att gora" list, its page directly
reachable, and every non-AI HTTP route open. Its whole value is AI field
extraction (Claude Sonnet 4.6 via Bedrock), already the paid chokepoint
elsewhere, so gate the whole surface on CAPABILITY.ai.

- EXTENSION_REQUIRED_CAPABILITY map + resolvers (keys.ts, sectors.ts) as the
  single source the nav item, the page, and the API dispatcher all read.
- Hide the sidebar item, command-palette entry, and home inbox row for
  non-payers; subtract inbox_document from the "Att gora" total via one shared
  visibleWorklistTotal helper (KPI tile + header cannot drift), clamped to >= 0.
- Block the /e/[sector]/[slug] page (fail-closed) with an upsell EmptyState.
- Enforce the capability in the extension API dispatcher (the single chokepoint
  that already enforces MFA), so every company-context inbox route 403s. The
  skipAuth /inbound webhook stays open (freeze-and-retain).
- FORCE_PAYWALL=true override so the real gate is exercisable in local dev.
- Tests: gating resolver, FORCE_PAYWALL, dispatcher 403/allow/webhook-exempt,
  visibleWorklistTotal, and enable-banking /connect + /sync 403.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/extensions/_generated/sector-definitions.ts

@@ -98,7 +98,7 @@ export const EXTENSION_DEFINITIONS: Record<string, ExtensionDefinition[]> = {
           "icon": "Inbox",
           "dataPattern": "both",
           "description": "Vidarebefordra leverantörsfakturor till en unik adress: dokumenten landar här med extraherade fält",
-          "longDescription": "Varje bolag får en unik fakturainkorg-adress. Fakturor som skickas dit fångas automatiskt och fält som org.nr, OCR, bankgiro, belopp och förfallodatum läses av med AI (kräver AI-funktionen). Utan AI lagras dokumentet ändå och fälten fylls i manuellt.",
+          "longDescription": "Varje bolag får en unik fakturainkorg-adress. Fakturor som skickas dit fångas automatiskt och fält som org.nr, OCR, bankgiro, belopp och förfallodatum läses av med AI. Kräver AI-funktionen i din prenumeration.",
           "readsCoreTables": [
                 "document_attachments",
                 "suppliers"

lib/extensions/sectors.ts

@@ -1,6 +1,8 @@
 import type { Sector, SectorSlug, ExtensionDefinition } from './types'
 import { EXTENSION_DEFINITIONS } from './_generated/sector-definitions'
 import { WORKSPACES } from './_generated/workspace-map'
+import { requiredCapabilityForExtension } from '@/lib/entitlements/keys'
+import type { CapabilityKey } from '@/lib/entitlements/keys'
 
 // ============================================================
 // Sector & Extension Registry
@@ -40,6 +42,17 @@ export function getExtensionDefinition(sectorSlug: string, extensionSlug: string
   return sector?.extensions.find(e => e.slug === extensionSlug)
 }
 
+/**
+ * Paid capability an extension requires, resolved by its registry id (== slug).
+ * The API-route dispatcher keys off this so a paid extension is gated at the
+ * request chokepoint, reusing the same EXTENSION_REQUIRED_CAPABILITY map that
+ * hides its sidebar item and blocks its page (lib/entitlements/keys).
+ */
+export function requiredCapabilityForExtensionId(extensionId: string): CapabilityKey | undefined {
+  const ext = getAllExtensions().find(e => e.slug === extensionId)
+  return ext ? requiredCapabilityForExtension(ext.sector, ext.slug) : undefined
+}
+
 export function getAllExtensions(): ExtensionDefinition[] {
   return SECTORS.flatMap(s => s.extensions)
 }