docs(skills): Sweden's Peppol Authority is Upphandlingsmyndigheten, not DIGG (#1736)

The e-handel and Peppol functions moved from DIGG to Upphandlingsmyndigheten
on 1 July 2026 (regeringsbeslut Fi2025/01826). The skill was written before the
handover and still told agents to sign with DIGG and mail peppol@digg.se.

Corrected across all eight files of the atom, repointed four digg.se URLs to
their verified redirect targets, and replaced the discontinued DIGG Peppol
testbadd (hard 404, no successor) with the SFTI Validex verification service.

Also refreshed the Service Provider path in peppol-network.md, which was thin
on what the process actually costs and requires:

- ISO/IEC 27001 mandatory for every Service Provider from 1 July 2027, with the
  1 Sept 2026 and 1 Oct 2026 interim milestones and the required SoA scope
- the SP Agreement clauses that drive product design: 9.2 end user
  identification, 9.7 authority-ordered blocking, 9.4.2 logging floor, 15
  subcontracting (the basis of the white-label market), 18 penalties, 19.3
  liability caps, 22 auto-termination on membership lapse
- the six Testbed cases and their prerequisites, including TLS grade A
- mandatory monthly TSR and EUSR reporting
- SMP-only fee row, and why AP-only is a trap for a SaaS vendor
- clause 14.3: a Peppol Authority may not charge for connecting

Regenerated the atom body migration (npm run skills:generate).

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

DECISIONS.md

@@ -1246,3 +1246,4 @@ One line per decision: `[YYYY-MM-DD] <decision>: <why>`. Appended by agents and
 [2026-08-25] ROT/RUT BegartBelopp truncates to whole kronor (truncateToWholeKronor), not half-up: the deduction is capped at 50%/30% of arbetskostnaden. At the RUT cap, half-up manufactured begart > betalt and blocked correct invoices; for ROT below the cap it over-requested past the cap and the 1513 fordran, so those files now ask 1 kr less (skeptic-verified on PR #1910).
 [2026-08-25] Woo bulk revenue template = per-rate account choice, no hardcoded varor/tjanster preset: BAS 2026 has no standard 30xx goods/services subdivision (3040-series is company-specific), so presets would invent accounts; chosen accounts are validated against the company chart instead, and only diffs from the 3001-series default are sent.
 [2026-08-26] RFC 9728 protected-resource metadata is served at THREE locations (root, path-based /.well-known/oauth-protected-resource/<mcp path>, and <mcp url>/.well-known/oauth-protected-resource): Claude.ai's connector setup derives the metadata URL from the server URL and fetches it before any 401, so the root document our WWW-Authenticate header points at was not enough ('Authorization with Accounted failed' with only 404s in the logs). One builder, three routes; the path-based route answers 404 for any path other than the MCP endpoint so no phantom resource is advertised.
+[2026-08-20] The swedish-e-invoicing skill now names Upphandlingsmyndigheten as Sweden Peppol Authority across all eight files, not just the one that was flagged: the handover completed 1 July 2026 (regeringsbeslut Fi2025/01826) and the skill was written in future tense, so a partial fix would have left the atom internally contradictory and still pointed agents at peppol@digg.se. Four digg.se URLs were repointed to their verified 301 targets on upphandlingsmyndigheten.se; the fifth, DIGG Peppol testbadd, is a hard 404 with no redirect and no successor page at the new authority, so it was replaced with the SFTI Validex verification service (https://sfti.validex.net/) rather than left dead or guessed at. Historical attributions (Q4 2025 traffic statistics, the 0007:2021006883 Peppol-ID example) deliberately still say DIGG because they were accurate when published.