feat(salary): let an enskild firma employ staff while blocking owner/board payroll (#797)

An enskild firma that hires staff should get the payroll module, but its owner
or board can never be on payroll (owner compensation is egna uttag / BAS 2013,
not lön).

- Migration 20260628120000 adds the enforce_ef_no_owner_employee trigger
  (BEFORE INSERT OR UPDATE OF employment_type) as the all-paths backstop.
- lib/salary/employment-rules.ts is the app-layer mirror (forbidden set kept
  byte-identical to the trigger); getCompanyEntityType() resolves the same
  company_settings -> companies precedence.
- The two UI salary routes and the v1 POST guard before insert/update for a
  clean 400 with guidance.
- Payroll nav + Lön settings now show for any employer (aktiebolag OR
  company_settings.pays_salaries), wired through the dashboard layout.

Fixes #782.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

types/index.ts

@@ -35,6 +35,11 @@ export interface Company {
   archived_at: string | null
   created_at: string
   updated_at: string
+  // Denormalised from company_settings onto the active company in the
+  // dashboard layout so context consumers (e.g. the settings rail) can tell
+  // whether the company is a registered employer without an extra fetch.
+  // Optional because it isn't a column on `companies`. #782
+  pays_salaries?: boolean
 }
 
 // Company membership