feat(import/export): article import + register export (xlsx/csv) (#750)

* feat(import/export): article import + register export (xlsx/csv)

Add CSV/Excel import for the article register (artiklar), mirroring the
existing customer/supplier import pipeline, plus Excel + CSV export for
articles, customers and suppliers.

Import (lib/import/articles + app/api/import/articles):
- Column auto-detection tuned to Fortnox/Visma/Bokio export headers,
  Swedish-decimal price parsing, VAT snapped to {0,6,12,25}, type/unit
  normalization.
- Dedup by article number then name; 23505 soft-skip; auto-number
  backfill; revenue-account override kept only when active, otherwise
  dropped with a warning (never mutates the chart of accounts).
- New "Artiklar" flow in the /import hub.

Export (app/api/export/* + lib/export/register-export):
- Read-only xlsx (default) / csv (?format=csv, UTF-8 BOM) downloads.
- Headers chosen so files round-trip back through the importer.
- "Exportera" menu added to the articles, customers and suppliers pages.

Refs #746. Direct Fortnox/Visma API article fetch tracked in #749.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(import/export): address PR review — lint ratchet + export hardening

- xlsx-export: keep `SheetSpec<any>` on the eslint-disabled line (fixes the
  core-only lint ratchet regression: no-explicit-any 16 -> 15) and define
  UTF8_BOM as an explicit `` escape instead of a raw BOM character.
- export routes (articles/customers/suppliers): move the data queries inside
  the try/catch, add `Cache-Control: no-store`, and emit a `register exported`
  audit log line (entity, format, rowCount).
- articles parse route: validate `column_overrides` against a Zod schema before
  trusting it to drive the parser.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(import): drop öre-round pattern on article column-detector confidence

The confidence score is a 0-1 heuristic, not money, and is only compared
against the 0.8 skip-mapping threshold. Removing the Math.round(x*100)/100
form clears the core-only antipattern ratchet (naive-ore-round 660 -> 659).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(import): flag adjusted VAT rows in the article import edit step

Surface VAT snapping/defaulting per row, not just as a file-level warning:
the parser sets `vat_rate_adjusted`, the edit step highlights those rows'
VAT selector and shows a count banner, and confirming a rate clears the flag.
Addresses the Swedish-compliance review note that silent snapping could
otherwise store a wrong VAT rate at scale.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/api/export/articles/__tests__/route.test.ts

@@ -0,0 +1,99 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import * as XLSX from 'xlsx'
+import { createMockRequest, parseJsonResponse, createQueuedMockSupabase } from '@/tests/helpers'
+import { detectArticleColumns } from '@/lib/import/articles/column-detector'
+
+const { supabase: mockSupabase, enqueue, reset } = createQueuedMockSupabase()
+
+vi.mock('@/lib/supabase/server', () => ({
+  createClient: () => Promise.resolve(mockSupabase),
+}))
+
+vi.mock('@/lib/company/context', () => ({
+  requireCompanyId: vi.fn().mockResolvedValue('company-1'),
+  getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
+}))
+
+const mockFetchAllRows = vi.fn()
+vi.mock('@/lib/supabase/fetch-all', () => ({
+  fetchAllRows: (...a: unknown[]) => mockFetchAllRows(...a),
+}))
+
+import { GET } from '../route'
+
+const mockUser = { id: 'user-1', email: 'test@test.se' }
+
+const ARTICLE = {
+  id: 'a1',
+  article_number: '100',
+  name: 'Webdesign',
+  name_en: 'Web design',
+  type: 'tjanst',
+  unit: 'st',
+  price_excl_vat: 1200,
+  vat_rate: 25,
+  revenue_account: '3001',
+  cost_price: 400,
+  ean: '7350000000001',
+  housework_type: null,
+  notes: 'Kommentar med åäö',
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  reset()
+  mockSupabase.auth.getUser.mockResolvedValue({ data: { user: mockUser } })
+  mockFetchAllRows.mockResolvedValue([ARTICLE])
+})
+
+describe('GET /api/export/articles', () => {
+  it('returns 401 when unauthenticated', async () => {
+    mockSupabase.auth.getUser.mockResolvedValue({ data: { user: null } })
+    const res = await GET(createMockRequest('/api/export/articles'))
+    const { status } = await parseJsonResponse(res)
+    expect(status).toBe(401)
+  })
+
+  it('returns an xlsx workbook whose headers round-trip through the importer', async () => {
+    enqueue({ data: { company_name: 'Acme AB' } })
+
+    const res = await GET(createMockRequest('/api/export/articles'))
+
+    expect(res.status).toBe(200)
+    expect(res.headers.get('Content-Type')).toContain('spreadsheetml')
+    const disposition = res.headers.get('Content-Disposition') || ''
+    expect(disposition).toContain('attachment')
+    expect(disposition).toContain('artiklar-acme-ab')
+    expect(disposition).toContain('.xlsx')
+
+    const buf = Buffer.from(await res.arrayBuffer())
+    expect(buf.length).toBeGreaterThan(0)
+
+    const wb = XLSX.read(new Uint8Array(buf), { type: 'array' })
+    const sheet = wb.Sheets[wb.SheetNames[0]]
+    const rows = XLSX.utils.sheet_to_json<string[]>(sheet, { header: 1 })
+    const headers = (rows[0] as string[]).map(String)
+    // Round-trip: the exported headers must re-detect with high confidence.
+    const detected = detectArticleColumns(headers)
+    expect(detected.confidence).toBeGreaterThanOrEqual(0.8)
+    expect(detected.name_col).toBeGreaterThanOrEqual(0)
+    expect(detected.price_col).not.toBeNull()
+    expect(detected.vat_rate_col).not.toBeNull()
+    expect(detected.revenue_account_col).not.toBeNull()
+  })
+
+  it('returns a UTF-8 BOM CSV when format=csv', async () => {
+    enqueue({ data: { company_name: 'Acme AB' } })
+
+    const res = await GET(createMockRequest('/api/export/articles', { searchParams: { format: 'csv' } }))
+
+    expect(res.status).toBe(200)
+    expect(res.headers.get('Content-Type')).toContain('text/csv')
+    expect(res.headers.get('Content-Disposition')).toContain('.csv')
+
+    const buf = Buffer.from(await res.arrayBuffer())
+    // UTF-8 BOM
+    expect([buf[0], buf[1], buf[2]]).toEqual([0xef, 0xbb, 0xbf])
+    expect(buf.toString('utf-8')).toContain('Webdesign')
+  })
+})