fix(inbox): sync matched_transaction_id on MCP-staged document attach (#549)

* fix(inbox): sync matched_transaction_id on MCP-staged document attach

The REST attach route (app/api/transactions/[id]/attach-document) already
updates invoice_inbox_items.matched_transaction_id so the inbox list shows
the "Kopplad till transaktion" indicator. The MCP-staged path through
commitAttachDocumentToTransaction did not, leaving inbox rows looking
unprocessed after a /pending approval. Mirror the REST behaviour with a
best-effort UPDATE (idempotent, gated on both FK columns being NULL).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(review): inspect supabase error on best-effort inbox link

The Supabase client resolves with { error } rather than rejecting on
RLS/DB failures, so the previous try/catch wrapping the inbox UPDATE
never fired for the documented failure modes — the console.error was
dead code. Switch to destructured { error } + if-block, matching the
pattern used elsewhere in commit.ts.

Applied to both the new MCP-staged path (lib/pending-operations/commit.ts)
and the pre-existing REST route (app/api/transactions/[id]/attach-document/
route.ts) it was mirrored from. Both tests now assert console.error fires
with the expected payload, so the swallow-and-log path is exercised for
real instead of passing for the wrong reason.

Addresses Greptile P1 + P2 on PR #549.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/api/transactions/[id]/attach-document/__tests__/route.test.ts

@@ -126,6 +126,13 @@ describe('POST /api/transactions/[id]/attach-document', () => {
     // Side-effect failure must not roll back the (compliant) document attach.
     expect(status).toBe(200)
     expect(body.data.transaction_id).toBe('tx-1')
+    // The Supabase client resolves with { error } rather than rejecting, so
+    // we additionally assert that the error was actually inspected and logged
+    // (not silently dropped by a try/catch that never fires).
+    expect(spy).toHaveBeenCalledWith(
+      '[attach-document] Failed to link inbox item:',
+      expect.objectContaining({ message: 'rls denied' }),
+    )
     spy.mockRestore()
   })
 })

app/api/transactions/[id]/attach-document/route.ts

@@ -87,16 +87,18 @@ export async function POST(
   // as matched so the inbox UI can show it as "Kopplad" + link back to the
   // transaction. Best-effort: a failure here must not roll back the
   // (compliant) document attach.
-  try {
-    await supabase
-      .from('invoice_inbox_items')
-      .update({ matched_transaction_id: transactionId })
-      .eq('document_id', document_id)
-      .eq('company_id', companyId)
-      .is('matched_transaction_id', null)
-      .is('created_supplier_invoice_id', null)
-  } catch (linkErr) {
-    console.error('[attach-document] Failed to link inbox item:', linkErr)
+  //
+  // The Supabase client resolves with { error } rather than rejecting on
+  // RLS/DB errors, so we destructure rather than try/catch.
+  const { error: inboxLinkErr } = await supabase
+    .from('invoice_inbox_items')
+    .update({ matched_transaction_id: transactionId })
+    .eq('document_id', document_id)
+    .eq('company_id', companyId)
+    .is('matched_transaction_id', null)
+    .is('created_supplier_invoice_id', null)
+  if (inboxLinkErr) {
+    console.error('[attach-document] Failed to link inbox item:', inboxLinkErr)
   }
 
   // Rättelse audit trail (BFL 5 kap 5 §): record swaps where a non-null doc