feat(inbox): staged upload ack, HEIC/HEIF validation, WhatsApp silence fixes (#1605)

* fix(whatsapp): app-side unmute, close silent intake paths, health visibility

- add POST /link/unmute and a Reactivate control on the Pausad state
- company resolution: transient query errors release the row for sweep
  retry; genuine zero-options sends M19 instead of parking silently
- media from unlinked senders bypasses the hourly greeting throttle
  (10 min burst window, daily cap kept)
- GET /link returns 7-day failed-delivery and parked-inbound counts;
  sweep summary logs outboundFailed24h

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(documents): real HEIC/HEIF magic-byte validation, bilingual upload errors

- detect ISO-BMFF ftyp brands (heic/heix/heim/heis/hevc/hevx/hevm/hevs,
  mif1/msf1) instead of exempting image/heic from validation; declared
  heic/heif accepts either family member (iOS labels vary)
- new INBOX_UPLOAD_* structured error codes replace raw English strings
  on the inbox upload and attach-document routes
- registry doc corrected to the real 10 MB cap

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(inbox): staged upload with instant ack and deferred AI extraction

- web uploads insert the inbox item as status processing and respond
  immediately; Bedrock extraction and supplier match run via after()
  with a CAS flip to received (email and WhatsApp channels keep the
  synchronous path)
- widen invoice_inbox_items.status CHECK to include processing
  (migration 20260813180000, pg-real test included)
- crash-recovery sweep cron (*/2) flips stale processing rows;
  bulk-book skips extraction_in_progress items
- workspace: processing chip, in-flight rows disable actions, realtime
  flip, retry-extraction button for empty extractions
- picker accept list drops HEIC/HEIF so iOS transcodes library photos
  to JPEG; server allowlists unchanged (supersedes 2026-08-01 HEIC
  decision, see DECISIONS.md)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(migrations): bump inbox processing-status migration past main's latest

Main merged 20260813210000 while this PR was in flight; an inserted
version older than the latest applied aborts the prod db push at merge.
Renamed 20260813180000 to 20260813213000 and updated references.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(decisions): log preview-tracker orphan repair after migration rename

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/transactions/__tests__/categorize-core.bulk.test.ts

@@ -179,6 +179,18 @@ describe('bulkBookMatchedInboxItems: skip classification (never errors)', () =>
     expect(mockCreateJE).not.toHaveBeenCalled()
   })
 
+  it("skips an item whose staged extraction is still in flight (status 'processing')", async () => {
+    // Staged upload: the row exists with extracted_data NULL while the
+    // deferred worker runs. Matched or not, it must not book from empty data.
+    const supabase = queuedSupabase([
+      { data: { id: 'i1', status: 'processing', matched_transaction_id: 'tx-1', created_journal_entry_id: null, created_supplier_invoice_id: null } },
+    ])
+    const { booked, skipped } = await bulkBookMatchedInboxItems(supabase, 'u1', 'c1', { ...base, item_ids: ['i1'] })
+    expect(booked).toEqual([])
+    expect(skipped).toEqual([{ item_id: 'i1', reason: 'extraction_in_progress' }])
+    expect(mockCreateJE).not.toHaveBeenCalled()
+  })
+
   it('skips an item already booked (created_journal_entry_id)', async () => {
     const supabase = queuedSupabase([
       { data: { id: 'i1', matched_transaction_id: 'tx-1', created_journal_entry_id: 'je-x', created_supplier_invoice_id: null } },

lib/transactions/categorize-core.ts

@@ -427,9 +427,9 @@ export interface BulkBookInboxResult {
 /**
  * Book each selected inbox item against its matched bank transaction with one
  * shared category + VAT treatment. Items without a matched transaction, already
- * booked, or already linked to a leverantörsfaktura are skipped: never an
- * error: so one bad underlag never blocks the rest ("Bokför valda hoppar
- * över"). A per-item throw (period locked, accounts not in chart) is caught and
+ * booked, already linked to a leverantörsfaktura, or still mid AI extraction
+ * (staged upload, status 'processing') are skipped: never an error: so one bad
+ * underlag never blocks the rest ("Bokför valda hoppar över"). A per-item throw (period locked, accounts not in chart) is caught and
  * recorded as a skip with the actionable message.
  *
  * Shared by the direct UI route (POST /items/bulk-book) and the
@@ -457,7 +457,7 @@ export async function bulkBookMatchedInboxItems(
   for (const itemId of item_ids) {
     const { data: item, error: itemError } = await supabase
       .from('invoice_inbox_items')
-      .select('id, matched_transaction_id, created_journal_entry_id, created_supplier_invoice_id, channel_context')
+      .select('id, status, matched_transaction_id, created_journal_entry_id, created_supplier_invoice_id, channel_context')
       .eq('id', itemId)
       .eq('company_id', companyId)
       .maybeSingle()
@@ -466,6 +466,14 @@ export async function bulkBookMatchedInboxItems(
       skipped.push({ item_id: itemId, reason: 'not_found' })
       continue
     }
+    if ((item as { status?: string }).status === 'processing') {
+      // Staged upload: the row exists but its deferred AI extraction has not
+      // landed yet (extracted_data is NULL). Booking it now would mint a
+      // verifikat from an underlag nobody has read; the flip to 'received'
+      // arrives within seconds, so this is a "try again in a moment" skip.
+      skipped.push({ item_id: itemId, reason: 'extraction_in_progress' })
+      continue
+    }
     if (item.created_journal_entry_id) {
       skipped.push({ item_id: itemId, reason: 'already_booked' })
       continue