fix(enable-banking): reconnect supersedes the old connection and stops duplicate imports (#1728)

* fix(enable-banking): supersede the old connection on bank reconnect and stop renewal duplicates

A renewal performed via the bank list ("Anslut ny bank") created a second
bank_connections row and left the old one parked in 'expired' forever: an
eternal "Åtgärd krävs" card, a red status chip, transactions stranded on the
dead row (so the picker's gap-fill probe read the renewal as a first
connect), and re-imported history for no-IBAN accounts whose provider uids
change on re-authorization.

- New migration: additive superseded_by uuid (FK, ON DELETE SET NULL) +
  superseded_at + partial index on bank_connections. Status 'revoked' is
  reused for superseded rows (no CHECK change); superseded_by disambiguates
  a supersede from a user disconnect. File only: not applied anywhere yet.
- New lib/supersede.ts: after the OAuth callback finalizes, park same-bank
  siblings matched by IBAN overlap (an ACTIVE sibling without overlap is
  never touched; no-IBAN fallback only for dead siblings when neither side
  has IBANs), revoke their EB session only when countLiveSiblings says
  nobody shares it, re-point their transactions in id batches, demote
  leftover cash_accounts claims (the mirror then promotes them by IBAN),
  carry last_synced_at + initial_sync_* onto the survivor, and emit the new
  bank_connection.superseded audit event.
- /connect fresh path: 409 { code: 'EXISTING_CONNECTION',
  existing_connection_id } when a non-revoked same-bank row exists, unless
  the body carries force_new: true (escape hatch for a second login at the
  same bank). Runs after the zombie sweep; reconnect-in-place unaffected.
- Dedup scope stability: StoredAccount.dedup_scope pins the external_id
  account scope at first ingest (normalized IBAN, else the uid of that
  moment), is carried across in-place reconnects and supersedes by IBAN
  match, and sync.ts uses dedup_scope ?? IBAN ?? uid (stamping legacy rows
  lazily). The external_id FORMAT is untouched.
- AccountPickerDialog gap-fill probe also includes superseded connection
  ids so the renewal default never races the transaction re-point.
- Sync toast (BankSyncNowButton) now also reports skipped duplicates
  (sv+en strings) so a correctly deduped renewal does not look broken.

Tests: supersede unit tests, /connect 409 + force_new, callback supersede
wiring + dedup-scope carry, sync external_id stability across uid changes.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(enable-banking): scope the connect 409 to dead siblings and harden supersede ordering

- POST /connect only 409s when the same-bank sibling is expired/error/
  pending_selection: an active row (a second legitimate login at the same
  bank) never blocks a fresh connect; force_new bypass kept. The 409 text
  now names the bank and points at Fornya samtycke.
- supersede parks the sibling row BEFORE revoking its EB session, and skips
  the revoke entirely (logged) when the park update fails, so a failed park
  can no longer leave a live-looking row with a dead session.
- callback keeps a survivor account's explicit dedup_scope instead of
  letting a carried sibling scope clobber it; carried scopes only apply
  when the survivor's scope was derived (IBAN/uid fallback).
- sync-now toast joins its two sentences with '. ' so the imported and
  skipped-duplicates messages no longer run together.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

DECISIONS.md

@@ -1091,3 +1091,4 @@ One line per decision: `[YYYY-MM-DD] <decision>: <why>`. Appended by agents and
 [2026-08-19] Periodisering auto-detect materiality floor uses entity_type as a K1 proxy: no stored flag distinguishes förenklat årsbokslut (K1, BFNAR 2006:1) from full årsbokslut (BFNAR 2017:3) for enskild firma, so every EF gets K1 wording and every AB gets K2, always advisory ("behöver normalt inte"), never prohibitive. Suggestions under 5 000 kr are tagged low-confidence (unticked) rather than dropped because the relief is a MAY, not a MUST; personnel-cost lines (7xxx) are exempt from the floor since K1/K2 require personnel costs to always be accrued.
 [2026-08-19] Hem build-assistant hero downgraded to the quiet-sentence pattern (AgentPromo, matches SkatteverketPromoCard; founder direction 2026-08-18 'redesign first, maybe remove later'): dismissal is per-company localStorage (erp_agent_promo_dismissed:<companyId>) like the SKV promo, gate and hasAi/billing routing unchanged.
 [2026-08-19] Banking settings UI state derives from a pure helper (extensions/general/enable-banking/lib/connection-state.ts), not inline JSX conditions: sort precedence, the single page-level .attn sentence, and each row's one primary action must agree on which state a connection is in, and only a pure module can unit-test that. The same-bank connect intercept excludes 'pending' rows (an in-flight authorization is not a renewable connection) and the fresh-connect body sends force_new: true after the intercept so the parallel 409 server guard can distinguish deliberate second connections; 'pending' rows now render as a spinner row ("Väntar på banken") for their whole lifetime instead of only locking the connect button for 30 s, since an invisible in-flight row was the confusion.
+[2026-08-19] Bank reconnect supersede reuses status 'revoked' plus a new superseded_by column instead of a new status value, and re-points transactions.bank_connection_id to the superseding row: every existing filter, ledger-claim release, and cron skip already handles 'revoked' correctly (no CHECK-constraint migration on a live table), superseded_by disambiguates a supersede from a user disconnect, and re-pointing the feed rows (plain FK metadata, never journal tables) is what makes the picker's gap-fill probe and per-connection scoping survive a renewal.