fix(vat): drop personnummer century so enskild firma VAT number is SE+12 not SE+14 (#796)

* fix(vat): drop personnummer century so enskild firma VAT number is SE+12 not SE+14

Onboarding derived the VAT number as SE${orgNumber}01. For an enskild firma the
org number is a 12-digit personnummer, producing SE + 14 digits, which fails the
^SE\d{12}$ validation — the pre-filled value is re-submitted on save and the tax
settings page becomes unsavable.

New shared helper lib/vat/vat-number.ts (normalize/validate/derive, reusing
normalizeOrgNumber to drop the century + Luhn-validate). UpdateSettingsSchema,
the onboarding wizard, the onboarding upsert in lib/company/actions.ts, and the
arcim-migration provider import all route through it. Backfill migration repairs
existing SE+14 rows to SE+12 (idempotent, scoped to ^SE\d{14}$ only).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(arcim): warn when a provider VAT number is dropped as malformed

The provider VAT guard silently discarded a value that doesn't normalise to a
valid SE+12 momsregistreringsnummer. Emit a structured warn (provider +
company, no raw value — it can embed a personnummer) so consistently-bad
provider data is observable rather than invisible. Addresses the OWASP V16
logging finding on the arcim VAT-normalisation change in this PR.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/vat/__tests__/vat-number.test.ts

@@ -0,0 +1,71 @@
+import { describe, it, expect } from 'vitest'
+import {
+  normalizeVatNumber,
+  isValidSwedishVatNumber,
+  deriveSwedishVatNumber,
+} from '@/lib/vat/vat-number'
+
+describe('normalizeVatNumber', () => {
+  it('uppercases and strips spaces and hyphens', () => {
+    expect(normalizeVatNumber('se 556123-4567 01')).toBe('SE556123456701')
+  })
+
+  it('leaves an already-canonical number unchanged', () => {
+    expect(normalizeVatNumber('SE556123456701')).toBe('SE556123456701')
+  })
+})
+
+describe('isValidSwedishVatNumber', () => {
+  it('accepts SE followed by exactly 12 digits', () => {
+    expect(isValidSwedishVatNumber('SE556123456701')).toBe(true)
+  })
+
+  it('rejects SE followed by 14 digits (century not dropped)', () => {
+    expect(isValidSwedishVatNumber('SE19900101123401')).toBe(false)
+  })
+
+  it('rejects lowercase / spaced input (must be normalised first)', () => {
+    expect(isValidSwedishVatNumber('se556123456701')).toBe(false)
+    expect(isValidSwedishVatNumber('SE 556123 4567 01')).toBe(false)
+  })
+
+  it('rejects a non-SE prefix', () => {
+    expect(isValidSwedishVatNumber('DE123456789')).toBe(false)
+  })
+})
+
+describe('deriveSwedishVatNumber', () => {
+  it('derives from a 10-digit aktiebolag org number (used as-is + 01)', () => {
+    // 5561234567 is a valid-Luhn organisationsnummer
+    expect(deriveSwedishVatNumber('5561234567')).toBe('SE556123456701')
+  })
+
+  it('accepts hyphen-formatted org numbers', () => {
+    expect(deriveSwedishVatNumber('556123-4567')).toBe('SE556123456701')
+  })
+
+  it('drops the century from a 12-digit personnummer (enskild firma)', () => {
+    // 19850101-0006 → 10-digit form 8501010006 → SE8501010006 01
+    expect(deriveSwedishVatNumber('198501010006')).toBe('SE850101000601')
+  })
+
+  it('derives from a 10-digit personnummer as-is', () => {
+    expect(deriveSwedishVatNumber('850101-0006')).toBe('SE850101000601')
+  })
+
+  it('returns null for a structurally invalid (bad Luhn) identity', () => {
+    expect(deriveSwedishVatNumber('1234567890')).toBeNull()
+  })
+
+  it('returns null for empty / nullish input', () => {
+    expect(deriveSwedishVatNumber('')).toBeNull()
+    expect(deriveSwedishVatNumber(null)).toBeNull()
+    expect(deriveSwedishVatNumber(undefined)).toBeNull()
+  })
+
+  it('never produces an SE+14 value from a 12-digit personnummer', () => {
+    const derived = deriveSwedishVatNumber('198501010006')
+    expect(derived).not.toBeNull()
+    expect(isValidSwedishVatNumber(derived as string)).toBe(true)
+  })
+})

lib/vat/vat-number.ts

@@ -0,0 +1,45 @@
+import { normalizeOrgNumber } from '@/lib/company-lookup/normalize-org-number'
+
+/**
+ * Swedish VAT registration number (momsregistreringsnummer) helpers.
+ *
+ * Canonical format per Skatteverket: "SE" + 10-digit identity + "01" = SE
+ * followed by exactly 12 digits, no spaces.
+ *  - Aktiebolag: the 10-digit organisationsnummer, used as-is.
+ *  - Enskild firma: the personnummer reduced to its 10-digit form (YYMMDD-NNNN).
+ *    A 12-digit personnummer (YYYYMMDD-NNNN) has its birth-century prefix
+ *    ('19'/'20') DROPPED first — including it would yield SE + 14 digits, which
+ *    is invalid. This is the bug that shipped from the onboarding wizard.
+ *
+ * The "01" suffix is the registration serial; it is effectively always "01" for
+ * a single registration.
+ */
+
+const SE_VAT_PATTERN = /^SE\d{12}$/
+
+/**
+ * Normalise raw user/provider input to the canonical spaceless, uppercase form.
+ * Strips whitespace and hyphens (e.g. "se 556677-8899 01" → "SE556677889901").
+ */
+export function normalizeVatNumber(raw: string): string {
+  return raw.replace(/[\s-]/g, '').toUpperCase()
+}
+
+/** Structural validity check: literal "SE" followed by exactly 12 digits. */
+export function isValidSwedishVatNumber(value: string): boolean {
+  return SE_VAT_PATTERN.test(value)
+}
+
+/**
+ * Derive a Swedish VAT number from an organisationsnummer or personnummer.
+ *
+ * Reuses {@link normalizeOrgNumber} to reach the canonical 10-digit identity
+ * (century dropped for 12-digit personnummer, Luhn-validated), then appends the
+ * "01" serial. Returns null when the input has no usable, structurally valid
+ * 10/12-digit identity — callers should leave the VAT number blank rather than
+ * persist a guess.
+ */
+export function deriveSwedishVatNumber(orgNumber: string | null | undefined): string | null {
+  const canonical = normalizeOrgNumber(orgNumber)
+  return canonical ? `SE${canonical}01` : null
+}