fix(import): SIE bulk-delete on service client + provider/reporting/b… (#724)

* fix(import): SIE bulk-delete on service client + provider/reporting/banking fixes

Rebuilt branch onto main as a single commit.

- import: run SIE bulk-delete RPCs on the service client to escape the 8s
  statement_timeout; undo_sie_import now takes an explicit actor (p_user_id)
  so its owner/admin gate works when auth.uid() is NULL on the service
  client (migration 20260624120000) + pg-real regression test
- providers: distinguish missing Fortnox license from expired connection;
  provider_consent_tokens PK regression test
- reports: include unmapped BAS expense groups in the income statement
- enable-banking: reconnect closed/expired bank sessions in place
- bookkeeping: surface linked invoices as underlag on the verifikat view
- scripts: track BL cleanup/diagnostic tooling; data files (*.csv) are
  git-ignored and consentId is now a required arg with no silent default

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(import): add Cache-Control header to journal entry references response

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/api/bookkeeping/journal-entries/[id]/references/route.ts

@@ -0,0 +1,30 @@
+import { NextResponse } from 'next/server'
+import { withRouteContext } from '@/lib/api/with-route-context'
+import { getJournalEntryUnderlagReferences } from '@/lib/core/bookkeeping/journal-entry-references'
+
+/**
+ * GET /api/bookkeeping/journal-entries/[id]/references
+ *
+ * Resolves the verifikation's followable underlag references — the linked
+ * customer / supplier invoices that identify the affärshändelse. Lets the
+ * verifikat view make the verifieringskedja traceable from the verifikat side,
+ * not only from the invoice side (BFL 5 kap 7§ — hänvisning till underlag;
+ * BFNAR 2013:2). Read-only.
+ *
+ * An id that doesn't belong to the active company resolves to no references
+ * (every underlying query is company-scoped), so this neither leaks nor 404s.
+ *
+ * Marked private, no-store: the payload carries invoice numbers (financial
+ * data), so no shared proxy / CDN may cache it across users or companies.
+ */
+export const GET = withRouteContext<{ params: Promise<{ id: string }> }>(
+  'journal_entry.references',
+  async (_request, { supabase, companyId }, { params }) => {
+    const { id } = await params
+    const references = await getJournalEntryUnderlagReferences(supabase, companyId, id)
+    return NextResponse.json(
+      { data: { references } },
+      { headers: { 'Cache-Control': 'private, no-store' } },
+    )
+  },
+)