feat(fortnox): make scope-approval flags overridable via env for self-hosted apps (#2069)

FORTNOX_DOCUMENT_SCOPES_APPROVED and FORTNOX_ASSET_SCOPES_APPROVED read env vars of the same name with the hosted registration's values as defaults, so a self-hosted Fortnox app avoids invalid_scope at authorize and the impossible reconnect loop without patching source. Supersedes #2001.

Co-authored-by: Pierre Gronberg <pierre@hbgdesignlab.se>

.env.example

@@ -61,6 +61,12 @@ RECEIPT_HUNT_COMPANY_IDS=
 # Hosted keeps this unset: public signup stays open there.
 # AUTH_SIGNUPS_DISABLED=false
 
+# Sign in with Google. Requires the Google provider to be configured in
+# Supabase/GoTrue first (Google Cloud OAuth client + redirect URI):
+# https://supabase.com/docs/guides/auth/social-login/auth-google
+# The button stays hidden until this is true.
+# NEXT_PUBLIC_GOOGLE_AUTH_ENABLED=true
+
 # Cloudflare Turnstile site key for Supabase Auth bot protection. This value is
 # public and is embedded in the browser bundle. Leave it unset until a widget
 # has been created for the deployment's exact hostnames. Deploy the site key
@@ -68,12 +74,6 @@ RECEIPT_HUNT_COMPANY_IDS=
 # existing login flow remains available throughout rollout.
 # NEXT_PUBLIC_TURNSTILE_SITE_KEY=
 
-# SAML SSO login (Enterprise). When enabled in Supabase GoTrue (saml_enabled),
-# the login page shows a SAML button. At least one of these is required to
-# tell Supabase which identity provider to redirect to:
-# NEXT_PUBLIC_SSO_DOMAIN=your-domain.okta.com   # discovers the provider by IdP domain
-# NEXT_PUBLIC_SSO_PROVIDER_ID=                   # explicit provider uuid (overrides domain)
-
 # ── Optional: extension features (core runs without these) ─
 # AI features (document extraction + AI assistant). Three ways to provide a
 # backend; set one of them. AI_PROVIDER (bedrock|anthropic|openai-compatible)
@@ -151,6 +151,14 @@ RECEIPT_HUNT_COMPANY_IDS=
 # FORTNOX_CLIENT_ID=
 # FORTNOX_CLIENT_SECRET=
 # FORTNOX_REDIRECT_URI=
+# Self-hosted only: which scopes YOUR Fortnox app registration carries in the
+# Fortnox Developer Portal. Unset means the hosted deployment's defaults
+# (documents true, assets false), which describe the hosted app, not yours.
+# Set to the registration's actual state: claiming an unapproved scope makes
+# Fortnox reject authorize with invalid_scope before login, and denying an
+# approved one just leaves that import feature off.
+# FORTNOX_DOCUMENT_SCOPES_APPROVED=true    # Arkivplats + Koppla filer (underlag import)
+# FORTNOX_ASSET_SCOPES_APPROVED=false      # Anlaggningsregister (asset register import)
 # Björn Lundén app credentials (OAuth2 client credentials; per-company
 # User-Key is entered by the user in the migration wizard)
 # BJORN_LUNDEN_CLIENT_ID=