fix(migration): resumable underlag import without inline extraction + same-origin MCP storage URLs (#1783)

* fix(migration): resumable underlag import without inline extraction, same-origin MCP storage URLs

The Fortnox underlag import ran every file's AI extraction inline inside
one request and hit the hosted 300 s function limit after ~17 of 113 files
(twice on 2026-08-21); the UI showed the generic "underlagen kunde inte
importeras" although the files it did reach were linked. The import now
works in time-budgeted slices with a stable cursor (the UI loops until the
server reports the end and shows "x av y") and opts out of extraction
(extractionOwner 'none', stamped skipped:opted_out): every file is linked
to its posted verifikat on arrival, so the booking is already known.

MCP signed Storage URLs (upload_url, signed_url, download_url) are served
through a same-origin proxy, /api/storage/[...path], because Claude
Desktop's sandbox only reaches the MCP host and blocked the PUT to
<project>.supabase.co. The signed token stays the only credential; the
proxy forwards only signed documents-bucket paths to our own Storage host
and is a no-op rewrite when NEXT_PUBLIC_APP_URL is unset.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013YoZ8iboyTj221axW6Gdtm

* fix(mcp): keep the storage-proxy note out of the size-capped tool descriptions

The per-tool 280-char cap and the tools/list payload ceiling both tripped on
the two sentences added to gnubok_create_document_upload and
gnubok_get_document_content; the why now lives in a code comment.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013YoZ8iboyTj221axW6Gdtm

* fix(review): id cursor, stall = error, capped upload body, encoded dot segments

Review follow-ups on #1783:
- the import cursor is the last handled provider attachment id, not an
  index, so a file Fortnox adds or removes mid-sweep shifts nothing
- a partial answer whose cursor does not advance (or the round guard) is
  reported as ARCIM_DOCUMENT_IMPORT_STALLED instead of "complete"; the
  slices already landed stay reported and the retry button resumes
- the storage proxy reads the PUT body as a capped stream instead of
  buffering an unbounded payload before measuring it
- object paths are rejected when any segment decodes to "." or ".." (or
  holds a separator), and the URL fetch() would actually request is
  re-checked against the allowlist after normalisation
- download_url description no longer claims a direct Storage URL

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013YoZ8iboyTj221axW6Gdtm

---------

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

extensions/general/document-extraction/__tests__/handler.test.ts

@@ -64,6 +64,13 @@ beforeEach(() => {
 describe('document-extraction handler', () => {
   // THE dedupe: inbox-owned documents are extracted (and mirrored) by the
   // inbox itself. The handler used to race it and pay a second model call.
+  it('stamps and skips when the uploader opted out (already-booked provider underlag)', async () => {
+    await handler(payload({ extractionOwner: 'none' }))
+
+    expect(extractMock).not.toHaveBeenCalled()
+    expect(lastStamp()).toBe('skipped:opted_out')
+  })
+
   it('yields entirely when the inbox owns extraction', async () => {
     await handler(payload({ extractionOwner: 'invoice-inbox' }))
     expect(supabase.from).not.toHaveBeenCalled()

extensions/general/document-extraction/index.ts

@@ -7,6 +7,7 @@ import { CAPABILITY } from '@/lib/entitlements/keys'
 import { createLogger } from '@/lib/logger'
 import { createServiceClient } from '@/lib/supabase/server'
 import type { DocumentAttachment } from '@/types'
+import type { DocumentExtractionOwner } from '@/lib/events/types'
 
 const log = createLogger('document-extraction')
 
@@ -62,9 +63,17 @@ export const documentExtractionExtension: Extension = {
           document: DocumentAttachment
           userId: string
           companyId: string
-          extractionOwner?: 'invoice-inbox'
+          extractionOwner?: DocumentExtractionOwner
         }
         if (extractionOwner === 'invoice-inbox') return
+        if (extractionOwner === 'none') {
+          // The uploader already holds the booking (provider underlag import
+          // links each file to its posted verifikat): a model pass would cost
+          // a paid call per file and, run inline, blew the 300 s route budget
+          // on a 113-file Fortnox import (2026-08-21). Stamp so nothing polls.
+          await stamp(createServiceClient(), document.id, 'skipped:opted_out')
+          return
+        }
         await extractAndPersist(document, companyId)
       },
     },