feat: BankID authentication via TIC Identity API (#192)

* feat: add BankID authentication via TIC Identity API

Integrate BankID as a login/signup method using the TIC Identity API.
Users can authenticate with BankID QR codes (desktop) or deep links (mobile),
link BankID to existing accounts, and skip TOTP MFA when BankID is linked.
Removes Step 0 (role choice) from onboarding for all users. Adds enrichment
data support for pre-filling company details from Bolagsverket during signup.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review — server-side rate limit, unlink clears MFA bypass

- Add per-IP rate limit (5s cooldown) on /bankid/start to prevent
  unbounded billable TIC sessions from unauthenticated callers
- Add /bankid/unlink endpoint that deletes bankid_identities AND clears
  app_metadata.bankid_linked so MFA enforcement resumes after unlink
- Update BankIdSettings to call server-side unlink instead of client-side delete

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: move rate limiter to module scope, add BankID logo and year-end skill

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

supabase/migrations/20260407100000_bankid_identities.sql

@@ -0,0 +1,40 @@
+-- BankID identity linking table
+-- Maps Supabase auth users to Swedish personnummer for BankID login.
+-- Personnummer stored as SHA-256 hash (lookup) + AES-256-GCM encrypted (display).
+
+create table public.bankid_identities (
+  id                   uuid primary key default uuid_generate_v4(),
+  user_id              uuid references auth.users on delete cascade unique not null,
+  personal_number_hash text not null,
+  personal_number_enc  bytea not null,
+  given_name           text,
+  surname              text,
+  linked_at            timestamptz not null default now(),
+  created_at           timestamptz not null default now(),
+  updated_at           timestamptz not null default now()
+);
+
+alter table public.bankid_identities enable row level security;
+
+-- Users can view their own BankID identity
+create policy "bankid_identities_select" on public.bankid_identities
+  for select using (auth.uid() = user_id);
+
+-- Users can link BankID to their own account
+create policy "bankid_identities_insert" on public.bankid_identities
+  for insert with check (auth.uid() = user_id);
+
+-- Users can unlink BankID from their account
+create policy "bankid_identities_delete" on public.bankid_identities
+  for delete using (auth.uid() = user_id);
+
+-- Fast lookup of returning BankID users by personnummer hash
+create unique index idx_bankid_identities_pnr_hash
+  on public.bankid_identities (personal_number_hash);
+
+create index idx_bankid_identities_user_id
+  on public.bankid_identities (user_id);
+
+create trigger bankid_identities_updated_at
+  before update on public.bankid_identities
+  for each row execute function public.update_updated_at_column();