fix(settings): validate share-capital pair before saving (#1137) (#1160)

* fix(settings): validate share-capital pair before saving (#1137)

Entering aktiekapital without antal aktier (or vice versa) died on the DB
pair constraint company_settings_share_capital_pair as a raw 500 with the
generic 'Vardet uppfyller inte de tillatna kraven' toast. The pair rule
(ARL 5 kap 14 $: the aktiekapital note needs both values) now surfaces as
a clear 400 in the PUT route, checked against effective body-or-stored
values so partial API updates are covered too. The form additionally marks
each field required when its sibling is filled, so the browser blocks a
one-sided submit before the request is sent.

Fixes #1137

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs: decision-log entry for share-capital pair validation placement

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(settings): correct the share-capital note citation to ÅRL 5 kap 34 §

5 kap 14 § is ställda säkerheter; the antal aktier/kvotvärde note is 5 kap 34 §
(flagged by the Swedish compliance review bot, verified against the
swedish-financial-reporting skill).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(settings): assert the pair message on the one-sided-clear rejection

CodeRabbit review on #1160. Its second suggestion (assert the update
payload on the partial-update test) is skipped: createQueuedMockSupabase
proxies away builder args, so payloads are not recordable, same as every
other test in this suite.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

app/api/settings/__tests__/route.test.ts

@@ -145,6 +145,71 @@ describe('PUT /api/settings', () => {
     }
   })
 
+  it('rejects aktiekapital without antal aktier with a clear message (issue #1137)', async () => {
+    enqueue({
+      data: {
+        entity_type: 'aktiebolag',
+        onboarding_complete: true,
+        aktiekapital: null,
+        antal_aktier: null,
+      },
+    })
+
+    const response = await PUT(createMockRequest('/api/settings', {
+      method: 'PUT',
+      body: { aktiekapital: 25000, antal_aktier: null },
+    }), { params: Promise.resolve({}) })
+    const { status, body } = await parseJsonResponse<{ error: string }>(response)
+
+    expect(status).toBe(400)
+    expect(body.error).toContain('antal aktier')
+    // The guard fired before the update: only the oldSettings fetch ran.
+    expect(supabase.from).toHaveBeenCalledTimes(1)
+  })
+
+  it('rejects clearing only one half of a stored share-capital pair', async () => {
+    enqueue({
+      data: {
+        entity_type: 'aktiebolag',
+        onboarding_complete: true,
+        aktiekapital: 25000,
+        antal_aktier: 500,
+      },
+    })
+
+    const response = await PUT(createMockRequest('/api/settings', {
+      method: 'PUT',
+      body: { antal_aktier: null },
+    }), { params: Promise.resolve({}) })
+    const { status, body } = await parseJsonResponse<{ error: string }>(response)
+
+    expect(status).toBe(400)
+    expect(body.error).toContain('antal aktier')
+    expect(supabase.from).toHaveBeenCalledTimes(1)
+  })
+
+  it('allows updating one half when the other half is already stored', async () => {
+    enqueueMany([
+      {
+        data: {
+          entity_type: 'aktiebolag',
+          onboarding_complete: true,
+          aktiekapital: 25000,
+          antal_aktier: 500,
+        },
+      },
+      { data: { id: 's1', aktiekapital: 50000, antal_aktier: 500 } },
+      { data: null, count: 5 },
+    ])
+
+    const response = await PUT(createMockRequest('/api/settings', {
+      method: 'PUT',
+      body: { aktiekapital: 50000 },
+    }), { params: Promise.resolve({}) })
+
+    expect((await parseJsonResponse(response)).status).toBe(200)
+  })
+
   it('updates invoice email recipients and payment accounts', async () => {
     const updates = {
       invoice_email_cc_addresses: ['info@example.com', 'owner@example.com'],