feat(dimensions): PR10 advanced — custom dimensions, hierarchy, account rules, commit enforcement (#886)

* feat(dimensions): PR10 advanced — custom dimensions, hierarchy, account rules, commit enforcement

The final rung of the dimensions ladder
(dev_docs/dimensions_implementation_plan.md §7 row 10):

- custom dimensions: POST /api/dimensions creates registry dims (next free
  SIE number >= 20 when omitted; explicit numbers allowed — SIE import
  already mints reserved ones); register gets a 'Ny dimension' dialog with
  a quiet Avancerat disclosure for the #UNDERDIM parent; GET now carries
  parent_sie_dim_no (the column + SIE round-trip existed since PR1/PR5 —
  this exposes it)
- account_dimension_rules (migration 20260703120000): one rule per
  (account, dimension) — required / default / fixed, per-rule is_active,
  company-scoped RLS, composite FK to the registry, value-presence CHECK
- enforcement, opt-in BY CONSTRUCTION (zero rules = engine byte-identical;
  deliberately NO settings toggle — a rule that exists but is ignored is
  worse than either extreme): default/fixed apply onto line bags at draft
  creation (fixed overwrites, default fills); required asserts at
  commitEntry with a Swedish MANDATORY_DIMENSION_MISSING naming every
  account + dimension; the bulk-book route runs the same policy before its
  RPC; storno/correction paths never pass through commitEntry so history
  always reverses regardless of policy; rule fetches fail open incl.
  thrown exceptions
- chart of accounts: per-account Dimensionsregler section in
  EditAccountDialog (Krävs/Förval/Låst, value picker, pause switch),
  gated on the existing dimensions toggle, quiet when empty
- pickers: LineDimensionFields is registry-driven (one combobox per active
  dimension, cached fetch, hardcoded 1/6 fallback) — every existing mount
  lights up custom dims with zero changes
- agent briefing: per-dimension required_on_accounts/default_on_accounts
  so agents self-correct instead of bouncing off the policy error
- rules CRUD API with existence/active/company validation and qualified
  DTO ids; firm_id FK deferred until the firms table lands (per plan)

39 new tests (pure-fn rules, engine enforcement, both new API surfaces,
pg-real RLS/CHECK/cascade suite); full suite 6,791 green; migration
replayed on a fresh container.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: renumber migration to 20260703200000 — version collision with prod

The concurrent session shipped pending_operations_add_link_document_to_voucher
as 20260703120000 today; the Supabase preview branch (cloned from prod)
rejected the duplicate version key.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix: review round — auto-pick retry on collision, fail-open warnings, query schema

- POST /api/dimensions retries once past a concurrent number claim when the
  number was auto-picked (explicit choices still 409)
- every fail-open skip of the dimension-rules policy now logs a structured
  warning (engine draft/commit paths + bulk-book) — deliberate fail-open,
  but observable
- GET /api/dimensions/rules validates its query through
  ListDimensionRulesQuerySchema instead of an inline regex

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/api/schemas.ts

@@ -841,6 +841,62 @@ export const CreateDimensionValueSchema = z
  * open period, lock date, active registry values); this schema only shapes
  * the request. An empty bag {} untags the line.
  */
+/**
+ * POST /api/dimensions — create a custom dimension (dimensions PR10).
+ * sie_dim_no omitted → server picks the next free number >= 20 (SIE leaves
+ * 20+ unreserved). parent_sie_dim_no declares an #UNDERDIM hierarchy.
+ */
+export const CreateDimensionSchema = z.object({
+  name: z.string().trim().min(1).max(60),
+  sie_dim_no: z.coerce.number().int().min(1).max(9999).optional(),
+  resets_annually: z.boolean().optional(),
+  parent_sie_dim_no: z.coerce.number().int().min(1).max(9999).nullable().optional(),
+})
+
+const AccountDimensionRuleTypeSchema = z.enum(['required', 'default', 'fixed'])
+
+/** GET /api/dimensions/rules query — optional exact-account filter. */
+export const ListDimensionRulesQuerySchema = z.object({
+  account_number: accountNumber.optional(),
+})
+
+/**
+ * POST /api/dimensions/rules — per-account dimension policy (dimensions
+ * PR10). 'required' carries no value; 'default'/'fixed' must carry the value
+ * to apply. One rule per (account, dimension) — enforced by the DB UNIQUE.
+ */
+export const CreateAccountDimensionRuleSchema = z
+  .object({
+    account_number: accountNumber,
+    dimension_id: uuid,
+    rule_type: AccountDimensionRuleTypeSchema,
+    value_id: uuid.optional(),
+    is_active: z.boolean().optional(),
+  })
+  .superRefine((rule, ctx) => {
+    if (rule.rule_type === 'required' && rule.value_id) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['value_id'],
+        message: 'En obligatorisk regel har inget värde — värden hör till Förval/Låst.',
+      })
+    }
+    if (rule.rule_type !== 'required' && !rule.value_id) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: ['value_id'],
+        message: 'Välj vilket värde regeln ska använda.',
+      })
+    }
+  })
+
+/** PATCH /api/dimensions/rules/[id] — the value-presence rule re-checks in the route (partial update). */
+export const UpdateAccountDimensionRuleSchema = z.object({
+  rule_type: AccountDimensionRuleTypeSchema.optional(),
+  value_id: uuid.nullable().optional(),
+  is_active: z.boolean().optional(),
+})
+
 export const RetagLineDimensionsSchema = z.object({
   // {} passes (no entries to validate) = UNTAG. Intentional divergence from
   // the MCP staged path (RetagLineDimensionsParamsSchema), which rejects an