fix(entitlements): gate the AI-only invoice-inbox for non-payers (#924)

The Dokumentinkorg (invoice-inbox) leaked past the paywall: visible in the
sidebar, command palette, and home "Att gora" list, its page directly
reachable, and every non-AI HTTP route open. Its whole value is AI field
extraction (Claude Sonnet 4.6 via Bedrock), already the paid chokepoint
elsewhere, so gate the whole surface on CAPABILITY.ai.

- EXTENSION_REQUIRED_CAPABILITY map + resolvers (keys.ts, sectors.ts) as the
  single source the nav item, the page, and the API dispatcher all read.
- Hide the sidebar item, command-palette entry, and home inbox row for
  non-payers; subtract inbox_document from the "Att gora" total via one shared
  visibleWorklistTotal helper (KPI tile + header cannot drift), clamped to >= 0.
- Block the /e/[sector]/[slug] page (fail-closed) with an upsell EmptyState.
- Enforce the capability in the extension API dispatcher (the single chokepoint
  that already enforces MFA), so every company-context inbox route 403s. The
  skipAuth /inbound webhook stays open (freeze-and-retain).
- FORCE_PAYWALL=true override so the real gate is exercisable in local dev.
- Tests: gating resolver, FORCE_PAYWALL, dispatcher 403/allow/webhook-exempt,
  visibleWorklistTotal, and enable-banking /connect + /sync 403.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/worklist/__tests__/visible-total.test.ts

@@ -0,0 +1,27 @@
+import { describe, it, expect } from 'vitest'
+import { visibleWorklistTotal, visibleWorklistTotalFrom } from '../visible-total'
+import type { WorklistCounts } from '../types'
+
+describe('visibleWorklistTotal', () => {
+  it('subtracts inbox documents for non-payers so the count matches the hidden row', () => {
+    expect(visibleWorklistTotal({ total: 5, inboxDocumentCount: 3, hasAi: false })).toBe(2)
+  })
+
+  it('keeps inbox documents for payers (the row is shown)', () => {
+    expect(visibleWorklistTotal({ total: 5, inboxDocumentCount: 3, hasAi: true })).toBe(5)
+  })
+
+  it('adds dashboard-only extras (expiring bank connections)', () => {
+    expect(visibleWorklistTotal({ total: 5, inboxDocumentCount: 3, hasAi: false, extra: 2 })).toBe(4)
+  })
+
+  it('clamps to 0 rather than rendering a negative count on a count skew', () => {
+    expect(visibleWorklistTotal({ total: 1, inboxDocumentCount: 3, hasAi: false })).toBe(0)
+  })
+
+  it('from() reads total + inbox_document off the worklist object', () => {
+    const worklist = { total: 4, counts: { inbox_document: 1 } } as unknown as WorklistCounts
+    expect(visibleWorklistTotalFrom(worklist, false, 1)).toBe(4) // 4 + 1 - 1
+    expect(visibleWorklistTotalFrom(worklist, true, 1)).toBe(5) // 4 + 1 - 0
+  })
+})

lib/worklist/index.ts

@@ -1,3 +1,4 @@
 export * from './types'
 export * from './categories'
 export * from './aggregate'
+export * from './visible-total'

lib/worklist/visible-total.ts

@@ -0,0 +1,39 @@
+import type { WorklistCounts } from './types'
+
+/**
+ * The "Att göra" total as the user actually sees it. The raw worklist total
+ * counts inbox_document, but the Dokumentinkorg is a paid (AI) surface hidden
+ * from non-payers, so its documents must not inflate the count either, else the
+ * dashboard tile shows "N att göra" over a section that renders no such row.
+ *
+ * Single source for the KPI tile (DashboardContent) and the section header
+ * (AttGoraSection): both must agree, and a mismatch here was a real bug. `extra`
+ * carries dashboard-only additions (expiring bank connections) that are not a
+ * lib/worklist category.
+ */
+export function visibleWorklistTotal(params: {
+  total: number
+  inboxDocumentCount: number
+  hasAi: boolean
+  extra?: number
+}): number {
+  const { total, inboxDocumentCount, hasAi, extra = 0 } = params
+  // total already includes inbox_document, so the subtraction is >= 0 in normal
+  // operation; clamp anyway so a transient count skew can never render a
+  // nonsense negative "N att gora" on the dashboard tile.
+  return Math.max(0, total + extra - (hasAi ? 0 : inboxDocumentCount))
+}
+
+/** Convenience overload taking the whole counts object. */
+export function visibleWorklistTotalFrom(
+  worklist: WorklistCounts,
+  hasAi: boolean,
+  extra = 0,
+): number {
+  return visibleWorklistTotal({
+    total: worklist.total,
+    inboxDocumentCount: worklist.counts.inbox_document,
+    hasAi,
+    extra,
+  })
+}