feat(import/export): article import + register export (xlsx/csv) (#750)

* feat(import/export): article import + register export (xlsx/csv)

Add CSV/Excel import for the article register (artiklar), mirroring the
existing customer/supplier import pipeline, plus Excel + CSV export for
articles, customers and suppliers.

Import (lib/import/articles + app/api/import/articles):
- Column auto-detection tuned to Fortnox/Visma/Bokio export headers,
  Swedish-decimal price parsing, VAT snapped to {0,6,12,25}, type/unit
  normalization.
- Dedup by article number then name; 23505 soft-skip; auto-number
  backfill; revenue-account override kept only when active, otherwise
  dropped with a warning (never mutates the chart of accounts).
- New "Artiklar" flow in the /import hub.

Export (app/api/export/* + lib/export/register-export):
- Read-only xlsx (default) / csv (?format=csv, UTF-8 BOM) downloads.
- Headers chosen so files round-trip back through the importer.
- "Exportera" menu added to the articles, customers and suppliers pages.

Refs #746. Direct Fortnox/Visma API article fetch tracked in #749.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(import/export): address PR review — lint ratchet + export hardening

- xlsx-export: keep `SheetSpec<any>` on the eslint-disabled line (fixes the
  core-only lint ratchet regression: no-explicit-any 16 -> 15) and define
  UTF8_BOM as an explicit `` escape instead of a raw BOM character.
- export routes (articles/customers/suppliers): move the data queries inside
  the try/catch, add `Cache-Control: no-store`, and emit a `register exported`
  audit log line (entity, format, rowCount).
- articles parse route: validate `column_overrides` against a Zod schema before
  trusting it to drive the parser.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(import): drop öre-round pattern on article column-detector confidence

The confidence score is a 0-1 heuristic, not money, and is only compared
against the 0.8 skip-mapping threshold. Removing the Math.round(x*100)/100
form clears the core-only antipattern ratchet (naive-ore-round 660 -> 659).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(import): flag adjusted VAT rows in the article import edit step

Surface VAT snapping/defaulting per row, not just as a file-level warning:
the parser sets `vat_rate_adjusted`, the edit step highlights those rows'
VAT selector and shows a count banner, and confirming a rate clears the flag.
Addresses the Swedish-compliance review note that silent snapping could
otherwise store a wrong VAT rate at scale.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/reports/xlsx-export.ts

@@ -109,7 +109,7 @@ function displayLength(value: CellValue, format: ColumnFormat): number {
 // single type parameter. Per-sheet type safety still applies inside each
 // `SheetSpec<TRow>` declaration.
 // eslint-disable-next-line @typescript-eslint/no-explicit-any, @typescript-eslint/no-unused-vars
-export function reportToWorkbook<_T = unknown>(spec: ReadonlyArray<SheetSpec<any>>): Buffer {
+export function reportToWorkbook<_T = unknown>(spec: ReadonlyArray<SheetSpec<any>>, options: { bookType?: 'xlsx' | 'csv' } = {}): Buffer {
   if (spec.length === 0) {
     throw new Error('reportToWorkbook: at least one sheet spec is required')
   }
@@ -176,11 +176,17 @@ export function reportToWorkbook<_T = unknown>(spec: ReadonlyArray<SheetSpec<any
     XLSX.utils.book_append_sheet(workbook, worksheet, truncatedName)
   }
 
-  // `XLSX.write` with `type: 'buffer'` returns a Node Buffer.
-  const out = XLSX.write(workbook, { type: 'buffer', bookType: 'xlsx' }) as Buffer
+  // `XLSX.write` with `type: 'buffer'` returns a Node Buffer. `bookType: 'csv'`
+  // emits only the first sheet (CSV is single-sheet) — fine for the flat,
+  // single-sheet register exports that use this option.
+  const bookType = options.bookType ?? 'xlsx'
+  const out = XLSX.write(workbook, { type: 'buffer', bookType }) as Buffer
   return out
 }
 
+/** UTF-8 byte-order mark (U+FEFF) so Excel opens CSV exports with åäö intact. */
+export const UTF8_BOM = '\uFEFF'
+
 // ─────────────────────────────────────────────────────────────────────────────
 // Column helpers — small declarative builders so route files read cleanly.
 // ─────────────────────────────────────────────────────────────────────────────
@@ -248,3 +254,20 @@ export function xlsxFilename(reportSlug: string, companyName: string, period: st
   const parts = [reportSlug, companySlug, periodCompact].filter(Boolean)
   return `${parts.join('-')}.xlsx`
 }
+
+/**
+ * Build a download filename `<slug>-<companySlug>-<dateYYYYMMDD>.<ext>`.
+ * Like `xlsxFilename` but with a caller-chosen extension (`'xlsx'` | `'csv'`),
+ * for register exports that offer both formats.
+ */
+export function exportFilename(
+  slug: string,
+  companyName: string,
+  date: string,
+  ext: 'xlsx' | 'csv',
+): string {
+  const companySlug = slugifyCompanyName(companyName)
+  const dateCompact = (date || '').replace(/-/g, '')
+  const parts = [slug, companySlug, dateCompact].filter(Boolean)
+  return `${parts.join('-')}.${ext}`
+}