fix(vat): drop personnummer century so enskild firma VAT number is SE+12 not SE+14 (#796)

* fix(vat): drop personnummer century so enskild firma VAT number is SE+12 not SE+14

Onboarding derived the VAT number as SE${orgNumber}01. For an enskild firma the
org number is a 12-digit personnummer, producing SE + 14 digits, which fails the
^SE\d{12}$ validation — the pre-filled value is re-submitted on save and the tax
settings page becomes unsavable.

New shared helper lib/vat/vat-number.ts (normalize/validate/derive, reusing
normalizeOrgNumber to drop the century + Luhn-validate). UpdateSettingsSchema,
the onboarding wizard, the onboarding upsert in lib/company/actions.ts, and the
arcim-migration provider import all route through it. Backfill migration repairs
existing SE+14 rows to SE+12 (idempotent, scoped to ^SE\d{14}$ only).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(arcim): warn when a provider VAT number is dropped as malformed

The provider VAT guard silently discarded a value that doesn't normalise to a
valid SE+12 momsregistreringsnummer. Emit a structured warn (provider +
company, no raw value — it can embed a personnummer) so consistently-bad
provider data is observable rather than invisible. Addresses the OWASP V16
logging finding on the arcim VAT-normalisation change in this PR.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

components/onboarding/Step4VatAccounting.tsx

@@ -14,6 +14,7 @@ import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@
 import { InfoTooltip } from '@/components/ui/info-tooltip'
 import { Loader2, ArrowRight, ArrowLeft, Info } from 'lucide-react'
 import { useToast } from '@/components/ui/use-toast'
+import { deriveSwedishVatNumber } from '@/lib/vat/vat-number'
 import type { MomsPeriod, EntityType } from '@/types'
 
 const schema = z.object({
@@ -82,12 +83,15 @@ export default function Step4VatAccounting({
   const vatNumber = watch('vat_number')
   const accountingMethod = watch('accounting_method')
 
-  // Auto-fill VAT number when vat_registered toggles on
+  // Auto-fill VAT number when vat_registered toggles on. Derive via the shared
+  // helper so a 12-digit personnummer (enskild firma) gets its century dropped —
+  // building SE${orgNumber}01 verbatim produced SE + 14 digits and failed
+  // validation on save.
   useEffect(() => {
     if (vatRegistered && !vatNumber && orgNumber) {
-      const cleaned = orgNumber.replace(/[-\s]/g, '')
-      if (cleaned.length >= 10) {
-        setValue('vat_number', `SE${cleaned}01`)
+      const derived = deriveSwedishVatNumber(orgNumber)
+      if (derived) {
+        setValue('vat_number', derived)
       }
     }
   }, [vatRegistered, vatNumber, orgNumber, setValue])