fix(import): SIE bulk-delete on service client + provider/reporting/b… (#724)

* fix(import): SIE bulk-delete on service client + provider/reporting/banking fixes

Rebuilt branch onto main as a single commit.

- import: run SIE bulk-delete RPCs on the service client to escape the 8s
  statement_timeout; undo_sie_import now takes an explicit actor (p_user_id)
  so its owner/admin gate works when auth.uid() is NULL on the service
  client (migration 20260624120000) + pg-real regression test
- providers: distinguish missing Fortnox license from expired connection;
  provider_consent_tokens PK regression test
- reports: include unmapped BAS expense groups in the income statement
- enable-banking: reconnect closed/expired bank sessions in place
- bookkeeping: surface linked invoices as underlag on the verifikat view
- scripts: track BL cleanup/diagnostic tooling; data files (*.csv) are
  git-ignored and consentId is now a required arg with no silent default

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(import): add Cache-Control header to journal entry references response

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/api/extensions/enable-banking/callback/__tests__/route.test.ts

@@ -34,7 +34,7 @@ function makeRequest(params: Record<string, string>) {
 
 function mockChain(result: { data?: unknown; error?: unknown }) {
   const chain: Record<string, unknown> = {}
-  for (const m of ['select', 'eq', 'single', 'update', 'order', 'limit']) {
+  for (const m of ['select', 'eq', 'in', 'single', 'update', 'order', 'limit']) {
     chain[m] = vi.fn().mockReturnValue(chain)
   }
   chain.single = vi.fn().mockResolvedValue({ data: result.data ?? null, error: result.error ?? null })

app/api/extensions/enable-banking/callback/route.ts

@@ -49,12 +49,14 @@ export async function GET(request: Request) {
       try {
         const supabase = await createServiceClient()
 
-        // Fetch connection details for logging before updating
+        // Fetch connection details for logging before updating. Match by
+        // oauth_state across pending/expired/error so an in-place reconnect
+        // (which stays 'expired' during the round-trip) is also handled.
         const { data: pendingConn } = await supabase
           .from('bank_connections')
           .select('id, user_id, bank_name')
           .eq('oauth_state', state)
-          .eq('status', 'pending')
+          .in('status', ['pending', 'expired', 'error'])
           .single()
 
         if (pendingConn) {
@@ -66,9 +68,16 @@ export async function GET(request: Request) {
             error_description: errorDescription,
           })
 
+          // If the bank reports a session-expiry during authorization itself,
+          // mark the row 'expired' (not generic 'error') so the settings panel
+          // surfaces the reconnect button rather than a dead-end error state.
+          const isSessionExpiry = /session.?expired|expired.?session|closed.?session|session.?closed|invalid.?session|session.?not.?found/i.test(
+            `${error} ${errorDescription ?? ''}`
+          )
+
           await supabase
             .from('bank_connections')
-            .update({ status: 'error', error_message: errorMessage, oauth_state: null })
+            .update({ status: isSessionExpiry ? 'expired' : 'error', error_message: errorMessage, oauth_state: null })
             .eq('id', pendingConn.id)
 
           // Include bank name and error code in redirect so the UI can offer PSU type retry
@@ -102,12 +111,16 @@ export async function GET(request: Request) {
   const supabase = await createServiceClient()
 
   try {
-    // Look up pending connection by oauth_state (CSRF-safe)
+    // Look up the connection awaiting this callback by oauth_state (CSRF-safe).
+    // oauth_state is a single-use random token cleared after use, so it uniquely
+    // identifies the row regardless of status. Accept 'expired'/'error' too: an
+    // in-place reconnect keeps the row in 'expired' during the round-trip (so
+    // the nightly stale-'pending' cleanup can't delete an established row).
     const { data: pendingConnection, error: findError } = await supabase
       .from('bank_connections')
       .select('id, user_id, company_id')
       .eq('oauth_state', state)
-      .eq('status', 'pending')
+      .in('status', ['pending', 'expired', 'error'])
       .single()
 
     if (findError || !pendingConnection) {
@@ -278,7 +291,7 @@ export async function GET(request: Request) {
         .from('bank_connections')
         .update({ status: 'error', error_message: error instanceof Error ? error.message : 'Connection failed', oauth_state: null })
         .eq('oauth_state', state)
-        .eq('status', 'pending')
+        .in('status', ['pending', 'expired', 'error'])
     } catch (cleanupError) {
       console.error('[enable-banking] Callback cleanup failed', {
         cleanupError: cleanupError instanceof Error ? cleanupError.message : String(cleanupError),