diff --git a/.gitea/workflows/ci.yml b/.gitea/workflows/ci.yml
index 27edcb062..21cd4dea9 100644
--- a/.gitea/workflows/ci.yml
+++ b/.gitea/workflows/ci.yml
@@ -5,8 +5,9 @@ on:
     branches: ["main"]
   workflow_dispatch:
 
+# N6 (server-config ci/jobbstorm-2026-11-10 §4): en ny commit på samma PR/gren avbryter den inaktuella körningen.
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  group: ${{ gitea.workflow }}-${{ gitea.ref }}
   cancel-in-progress: true
 
 jobs:
@@ -24,7 +25,7 @@ jobs:
           fetch-depth: 0
       - name: SonarQube analysis (self-hosted sonar.siax.io)
         env:
-          SONAR_HOST_URL: https://sonar.siax.io
+          SONAR_HOST_URL: https://sonar.siax.dev
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
         run: |
           set -euo pipefail
diff --git a/.gitea/workflows/masterplan-lock.yml b/.gitea/workflows/masterplan-lock.yml
index 6565d8a59..713f68d76 100644
--- a/.gitea/workflows/masterplan-lock.yml
+++ b/.gitea/workflows/masterplan-lock.yml
@@ -8,12 +8,13 @@ name: masterplan-lock
 
 on:
   push:
-    branches: ["**"]
+    branches: [main]
   pull_request:
   workflow_dispatch:
 
+# N6 (server-config ci/jobbstorm-2026-11-10 §4): en ny commit på samma PR/gren avbryter den inaktuella körningen.
 concurrency:
-  group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  group: ${{ gitea.workflow }}-${{ gitea.ref }}
   cancel-in-progress: true
 
 jobs:
diff --git a/.gitleaksignore b/.gitleaksignore
new file mode 100644
index 000000000..fcc434131
--- /dev/null
+++ b/.gitleaksignore
@@ -0,0 +1,102 @@
+# .gitleaksignore — exakta fingeravtryck för granskade falska positiva.
+#
+# Genererad 2026-11-11 från gitleaks v8.30.1 (samma version som security-grinden
+# pinnar) körd som directory-scan mot repots arbetsträd. Varje rad nedan är
+# granskad: träffen är en testfixtur, ett exempelvärde i dokumentation, en
+# hash/UUID eller ett miljövariabelnamn — inte en hemlighet. Ingen bred ignore:
+# endast dessa exakta fil:regel:rad-fingeravtryck undertrycks; nya fynd fäller
+# fortfarande grinden. Fingeravtrycken förutsätter att katalogen monteras på
+# /repo (så gör den kanoniska security-workflowen).
+
+# Klassificering (katalog — regel: antal):
+#
+# `lib/docs/content/cookbook` — curl-auth-header: 37 träff(ar)
+# `app/api/v1/companies/[companyId]/invoices/[id]/mark-paid/__tests__` — generic-api-key: 3 träff(ar)
+# `app/api/v1/companies/[companyId]/customers/__tests__` — generic-api-key: 3 träff(ar)
+# `app/api/v1/companies/[companyId]/invoices/[id]/send/__tests__` — generic-api-key: 2 träff(ar)
+# `app/api/v1/companies/[companyId]/transactions/[id]/match-supplier-invoice/__tests__` — generic-api-key: 2 träff(ar)
+# `app/api/v1/companies/[companyId]/transactions/[id]/match-invoice/__tests__` — generic-api-key: 2 träff(ar)
+# `app/api/v1/companies/[companyId]/invoices/__tests__` — generic-api-key: 2 träff(ar)
+# `app/api/v1/companies/[companyId]/settings/__tests__` — generic-api-key: 2 träff(ar)
+
+/repo/.claude/skills/gdpr-cicd-compliance/SKILL.md:generic-api-key:45
+/repo/app/(auth)/reset-password/__tests__/invite-handoff.test.ts:generic-api-key:30
+/repo/app/(auth)/auth/callback/__tests__/route.test.ts:generic-api-key:176
+/repo/app/api/v1/companies/[companyId]/customers/bulk-create/__tests__/route.test.ts:generic-api-key:71
+/repo/app/api/v1/companies/[companyId]/invoices/[id]/credit/__tests__/route.test.ts:generic-api-key:79
+/repo/app/api/v1/companies/[companyId]/invoices/[id]/mark-sent/__tests__/route.test.ts:generic-api-key:96
+/repo/app/api/v1/companies/[companyId]/invoices/bulk-create/__tests__/route.test.ts:generic-api-key:73
+/repo/app/api/v1/companies/[companyId]/invoices/[id]/send/__tests__/route.test.ts:generic-api-key:188
+/repo/app/api/v1/companies/[companyId]/invoices/[id]/send/__tests__/route.test.ts:generic-api-key:201
+/repo/app/api/v1/companies/[companyId]/invoices/[id]/mark-paid/__tests__/route.test.ts:generic-api-key:109
+/repo/app/api/v1/companies/[companyId]/invoices/[id]/mark-paid/__tests__/route.test.ts:generic-api-key:762
+/repo/app/api/v1/companies/[companyId]/invoices/[id]/mark-paid/__tests__/route.test.ts:generic-api-key:842
+/repo/app/api/v1/companies/[companyId]/reconciliation/bank/__tests__/route.test.ts:generic-api-key:108
+/repo/app/api/v1/companies/[companyId]/supplier-invoices/[id]/mark-paid/__tests__/route.test.ts:generic-api-key:113
+/repo/app/api/v1/companies/[companyId]/customers/__tests__/route.test.ts:generic-api-key:437
+/repo/app/api/v1/companies/[companyId]/customers/__tests__/route.test.ts:generic-api-key:450
+/repo/app/api/v1/companies/[companyId]/customers/__tests__/route.test.ts:generic-api-key:462
+/repo/app/api/v1/companies/[companyId]/transactions/[id]/match-supplier-invoice/__tests__/route.test.ts:generic-api-key:92
+/repo/app/api/v1/companies/[companyId]/transactions/[id]/match-supplier-invoice/__tests__/route.test.ts:generic-api-key:204
+/repo/app/api/v1/companies/[companyId]/transactions/[id]/match-invoice/__tests__/route.test.ts:generic-api-key:88
+/repo/app/api/v1/companies/[companyId]/transactions/[id]/match-invoice/__tests__/route.test.ts:generic-api-key:301
+/repo/app/api/v1/companies/[companyId]/transactions/ingest/__tests__/route.test.ts:generic-api-key:97
+/repo/app/api/v1/companies/[companyId]/invoices/__tests__/route.test.ts:generic-api-key:424
+/repo/app/api/v1/companies/[companyId]/invoices/__tests__/route.test.ts:generic-api-key:437
+/repo/app/api/v1/companies/[companyId]/transactions/[id]/categorize/__tests__/route.test.ts:generic-api-key:121
+/repo/app/api/v1/companies/[companyId]/settings/__tests__/route.test.ts:generic-api-key:81
+/repo/app/api/v1/companies/[companyId]/settings/__tests__/route.test.ts:generic-api-key:235
+/repo/app/invite/[token]/__tests__/invite-cookie.test.ts:generic-api-key:163
+/repo/app/api/v1/companies/[companyId]/transactions/batch-categorize/__tests__/route.test.ts:generic-api-key:111
+/repo/app/api/v1/companies/[companyId]/transactions/[id]/__tests__/route.test.ts:generic-api-key:170
+/repo/extensions/general/arcim-migration/__tests__/bl-lundify-activation.test.ts:generic-api-key:83
+/repo/extensions/general/arcim-migration/__tests__/bl-lundify-activation.test.ts:generic-api-key:84
+/repo/extensions/general/mcp-server/__tests__/create-customer.test.ts:generic-api-key:260
+/repo/extensions/general/mcp-server/__tests__/update-customer.test.ts:generic-api-key:372
+/repo/extensions/general/stripe/__tests__/payment-links.test.ts:generic-api-key:151
+/repo/lib/auth/__tests__/consume-invite-cookie.test.ts:generic-api-key:43
+/repo/lib/docs/content/landing.ts:curl-auth-header:16
+/repo/lib/docs/content/landing.ts:curl-auth-header:45
+/repo/lib/docs/content/cookbook/webhooks.ts:generic-api-key:40
+/repo/lib/docs/content/cookbook/webhooks.ts:curl-auth-header:18
+/repo/lib/docs/content/cookbook/webhooks.ts:curl-auth-header:62
+/repo/lib/docs/content/cookbook/webhooks.ts:curl-auth-header:93
+/repo/lib/docs/content/cookbook/webhooks.ts:curl-auth-header:122
+/repo/lib/docs/content/cookbook/webhooks.ts:curl-auth-header:158
+/repo/lib/docs/content/cookbook/webhooks.ts:curl-auth-header:174
+/repo/lib/docs/content/cookbook/file-vat-declaration.ts:curl-auth-header:18
+/repo/lib/docs/content/cookbook/file-vat-declaration.ts:curl-auth-header:110
+/repo/lib/docs/content/cookbook/file-vat-declaration.ts:curl-auth-header:121
+/repo/lib/docs/content/cookbook/ingest-bank-transactions.ts:curl-auth-header:18
+/repo/lib/docs/content/cookbook/ingest-bank-transactions.ts:curl-auth-header:44
+/repo/lib/docs/content/cookbook/ingest-bank-transactions.ts:curl-auth-header:81
+/repo/lib/docs/content/cookbook/ingest-bank-transactions.ts:curl-auth-header:123
+/repo/lib/docs/content/cookbook/ingest-bank-transactions.ts:curl-auth-header:166
+/repo/lib/docs/content/cookbook/ingest-bank-transactions.ts:curl-auth-header:198
+/repo/lib/docs/content/cookbook/year-end-closing.ts:curl-auth-header:20
+/repo/lib/docs/content/cookbook/year-end-closing.ts:curl-auth-header:57
+/repo/lib/docs/content/cookbook/year-end-closing.ts:curl-auth-header:75
+/repo/lib/docs/content/cookbook/year-end-closing.ts:curl-auth-header:91
+/repo/lib/docs/content/cookbook/year-end-closing.ts:curl-auth-header:114
+/repo/lib/docs/content/cookbook/year-end-closing.ts:curl-auth-header:161
+/repo/lib/docs/content/cookbook/year-end-closing.ts:curl-auth-header:176
+/repo/lib/docs/content/cookbook/year-end-closing.ts:curl-auth-header:189
+/repo/lib/docs/content/cookbook/year-end-closing.ts:curl-auth-header:193
+/repo/lib/docs/content/cookbook/year-end-closing.ts:curl-auth-header:205
+/repo/lib/docs/content/cookbook/year-end-closing.ts:curl-auth-header:209
+/repo/lib/docs/content/cookbook/quickstart.ts:curl-auth-header:8
+/repo/lib/docs/content/cookbook/quickstart.ts:curl-auth-header:35
+/repo/lib/docs/content/cookbook/quickstart.ts:curl-auth-header:76
+/repo/lib/docs/content/cookbook/quickstart.ts:curl-auth-header:119
+/repo/lib/docs/content/cookbook/quickstart.ts:curl-auth-header:151
+/repo/lib/docs/content/cookbook/run-payroll-and-agi.ts:curl-auth-header:18
+/repo/lib/docs/content/cookbook/run-payroll-and-agi.ts:curl-auth-header:57
+/repo/lib/docs/content/cookbook/run-payroll-and-agi.ts:curl-auth-header:90
+/repo/lib/docs/content/cookbook/run-payroll-and-agi.ts:curl-auth-header:106
+/repo/lib/docs/content/cookbook/run-payroll-and-agi.ts:curl-auth-header:125
+/repo/lib/docs/content/cookbook/run-payroll-and-agi.ts:curl-auth-header:164
+/repo/lib/providers/bjornlunden/__tests__/activation.test.ts:generic-api-key:27
+/repo/lib/providers/bjornlunden/__tests__/activation.test.ts:generic-api-key:33
+/repo/lib/reports/catalog.ts:generic-api-key:235
+/repo/scripts/api-skill/overlays/quickstart.md:curl-auth-header:6
+/repo/skills/accounted-api/SKILL.md:curl-auth-header:39