Bug/year end numbers (#744)

* fix(bookkeeping): allow creating a fiscal year that fills an interior gap

Fiscal-period creation only allowed chaining a new räkenskapsår before the
earliest or after the latest existing period, so a company with a gap between
years (e.g. 2024 + 2026 from an SIE import, missing 2025) could not create the
missing year — it failed with "New period must chain before the earliest or
after the latest existing period".

Generalise forward chaining onto the new period's immediate predecessor, which
covers both appending a new latest year and filling an interior gap. The
"prior year must be locked" guard now applies only to true appends, not gap
fills (a backfill, like backward chaining). previous_period_id is set to the
predecessor and the successor is relinked so the BFNAR 2013:2 continuity chain
stays intact. The create dialog suggests the missing year (capped so it never
overlaps the next period), the settings page seeds the dialog at the earliest
gap, and the default suggested name is now "Räkenskapsår <year>".

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(bookkeeping): omföra föregående års resultat (2099 → 2098) at year-end

Year-end closing posts the result to 2099 "Årets resultat" and the opening
balance carried it forward on 2099 every year, so 2099 accumulated across
years and the prior result never moved off "Årets resultat".

executeYearEndClosing now posts a separate "Omföring av föregående års
resultat" verifikat (Dr 2099 / Cr 2098 for a profit, reversed for a loss)
into the new period after the continuity check passes, so 2099 starts each
year at zero. Kept as a standalone entry rather than folded into the opening
balance so the IB stays a faithful mirror of the prior UB and IB/UB
continuity still holds. Aktiebolag only; idempotent; no-op when 2099 is flat.
The 2098 → 2091/2898 disposition (bolagsstämma decision) is intentionally
left to a separate step.

- new source_type 'result_appropriation' (migration + type + Zod enum)
- generateResultAppropriation helper (planner + poster) wired as step 11
- ResultStep surfaces the omföring voucher
- unit tests + pg-real invariant
- scripts/repair-result-appropriation.ts: retroactive catch-up (dry-run default)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(transactions): shadow-detect date-drift duplicate bank transactions

The content-dedup bridge buckets on exact (date, ore), so the same
transaction re-imported with a booking date that drifted a day lands in
a different bucket and slips past every dedup layer. Add a measure-only
("shadow") detector that flags would-be +/-1-day duplicates and counts
them, without changing what is inserted - so the gap can be validated on
real data before any enforcement, mirroring the scope-drift shadow.

- shiftIsoDate(): pure, deterministic adjacent-date helper
- ingest: DEDUP_DATE_DRIFT_MODE flag (default on), pre-loop bucket
  snapshot, per-row gate with desc-bridge + cross-channel-symmetry
  signals; logs shadow_date_drift_candidates, never alters inserts
- fail-safe date guard so the measurement can never abort an import
- regression tests for both signals, account/window/distinct guards,
  no-double-count, and the malformed-date fail-safe

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* test(bookkeeping): anonymize a customer reference in fiscal-period tests

Remove a real customer name ("AXMD AB") from regression-test comments;
no logic change.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(workflows): enhance Docker image scanning and caching mechanisms

* fix(bookkeeping): enhance year-end result appropriation handling and error reporting

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

types/index.ts

@@ -1251,6 +1251,7 @@ export type JournalEntrySourceType =
   | 'currency_revaluation'
   | 'reminder_fee'
   | 'accrual'
+  | 'result_appropriation'
 
 // Journal entry status
 export type JournalEntryStatus = 'draft' | 'posted' | 'reversed' | 'cancelled'
@@ -2711,6 +2712,24 @@ export interface YearEndResult {
   nextPeriod: FiscalPeriod
   openingBalanceEntry: JournalEntry
   revaluationEntry: JournalEntry | null
+  /**
+   * Year-open omföring av föregående års resultat (Dr 2099 / Cr 2098) posted
+   * into the new period so 2099 "Årets resultat" starts the year at zero.
+   * Aktiebolag only; null for enskild firma or when 2099 carried no balance.
+   * The further disposition 2098 → 2091/2898 is the stämma's decision and is
+   * intentionally left to a separate step.
+   */
+  resultAppropriationEntry: JournalEntry | null
+  /**
+   * True when the year-open omföring (2099 → 2098) was attempted but threw.
+   * The close + IB are already valid and immutable, so the failure is
+   * non-fatal to the year-end itself — but it leaves 2099 carrying the prior
+   * result into the new period, which is non-compliant. Surfaced so the UI can
+   * alert the user (and an alertable log line fires server-side); the
+   * retroactive catch-up script (scripts/repair-result-appropriation.ts) then
+   * posts the missing omföring. False on success or when there was nothing to do.
+   */
+  resultAppropriationFailed: boolean
   /**
    * IB/UB reconciliation per balance sheet account, computed after the
    * opening balances are posted. Surfaced to the UI's ResultStep so the
@@ -2995,6 +3014,14 @@ export interface IngestResult {
    * the rule would fire, so it can be validated on real data before enforcement.
    */
   shadow_scope_drift_candidates?: number
+  /**
+   * SHADOW-MODE counter: rows that an enforcing date-drift dedup rule WOULD have
+   * treated as re-imports — a twin with the same öre and an account-compatible,
+   * bridging (or cross-channel count-symmetric) match one day away, which the
+   * exact-date content bridge misses. Still imported; the field only measures
+   * how often the rule would fire, for validation before any enforcement.
+   */
+  shadow_date_drift_candidates?: number
 }
 
 // ── Invoice extraction (used by invoice-inbox extension and core utils) ──