fix(vat): drop personnummer century so enskild firma VAT number is SE+12 not SE+14 (#796)

* fix(vat): drop personnummer century so enskild firma VAT number is SE+12 not SE+14

Onboarding derived the VAT number as SE${orgNumber}01. For an enskild firma the
org number is a 12-digit personnummer, producing SE + 14 digits, which fails the
^SE\d{12}$ validation — the pre-filled value is re-submitted on save and the tax
settings page becomes unsavable.

New shared helper lib/vat/vat-number.ts (normalize/validate/derive, reusing
normalizeOrgNumber to drop the century + Luhn-validate). UpdateSettingsSchema,
the onboarding wizard, the onboarding upsert in lib/company/actions.ts, and the
arcim-migration provider import all route through it. Backfill migration repairs
existing SE+14 rows to SE+12 (idempotent, scoped to ^SE\d{14}$ only).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(arcim): warn when a provider VAT number is dropped as malformed

The provider VAT guard silently discarded a value that doesn't normalise to a
valid SE+12 momsregistreringsnummer. Emit a structured warn (provider +
company, no raw value — it can embed a personnummer) so consistently-bad
provider data is observable rather than invisible. Addresses the OWASP V16
logging finding on the arcim VAT-normalisation change in this PR.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/api/__tests__/schemas.test.ts

@@ -1144,6 +1144,31 @@ describe('UpdateSettingsSchema', () => {
     expect(result.success).toBe(true)
   })
 
+  it('normalises vat_number (lowercase, spaces, hyphens) to the canonical SE+12 form', () => {
+    const result = UpdateSettingsSchema.safeParse({
+      vat_registered: true,
+      vat_number: 'se 556123-4567 01',
+      moms_period: 'quarterly',
+    })
+    expect(result.success).toBe(true)
+    if (result.success) {
+      expect(result.data.vat_number).toBe('SE556123456701')
+    }
+  })
+
+  it('rejects vat_number with 14 digits (the SE + 12-digit personnummer + 01 bug)', () => {
+    const result = UpdateSettingsSchema.safeParse({
+      vat_registered: true,
+      vat_number: 'SE19900101123401',
+      moms_period: 'quarterly',
+    })
+    expect(result.success).toBe(false)
+    if (!result.success) {
+      const vatError = result.error.issues.find(i => i.path.includes('vat_number'))
+      expect(vatError?.message).toContain('SE följt av 12 siffror')
+    }
+  })
+
   it('allows aktiebolag with kontantmetoden (BFL 5 kap. 2 §)', () => {
     const result = UpdateSettingsSchema.safeParse({
       entity_type: 'aktiebolag',