feat(reports): log behandlingsregler changes and program versions (BFNAR 2013:2 p. 9.16) (#2097)

* feat(reports): log behandlingsregler changes and program versions (BFNAR 2013:2 p. 9.16)

Part 3 of the behandlingshistorik series (#1787 report, #1790 PDF). BFNAR
2013:2 punkt 9.16 second paragraph requires the behandlingshistorik to record
"forandringar i bokforingssystemet som paverkar bokforingsposternas behandling
samt nar dessa forandringar infordes", and BFN's commentary names
behandlingsregler (automatkonteringar, fasta procentsatser) and new program
versions as the examples. Until now both changed without a trace.

Audit triggers on the behandlingsregler tables and the import logs:
mapping_rules, booking_template_library, categorization_templates,
salary_payroll_config, sie_imports, bank_file_imports. categorization_templates
learns on every booking (occurrence_count, confidence, last_seen_date), so
those telemetry-only updates are excluded by a WHEN clause the same way the
api_keys request counters are (20260721115701): only real rule changes are
logged. Measured against prod that is roughly 3 800 new audit rows a month
against an audit_log already taking 371 688, so about +1 %.

app_releases is an append-only log of program versions seen in production,
written by the runtime the first time a build answers a request. Vercel exposes
no build hook we can trust to write the row, so /api/version records it inside
after(): the handler returns synchronously and a floating promise could be
frozen before the insert lands, which is how a version log ends up silently
empty. The service client is constructed lazily so the constantly polled public
probe pays nothing once the module guard is set.

Program versions are rolled up per Swedish calendar day in the report. main
takes ~570 merges a month, so one event per version would be on the order of
7 000 a fiscal year: enough to trip the PDF's own 4 000-event guard and bury the
~400 events a real company's year contains. The statutory unit is the date, and
the same sentence qualifies the requirement to changes that affect processing,
which a deploy list cannot distinguish anyway. app_releases keeps the
per-version truth for anyone who needs to go deeper.

AuditLogEntry.user_id becomes string | null. The column is nullable and
write_audit_log() falls back to auth.uid(), which is NULL for a service-role or
global write; the company-less salary_payroll_config rows are the first that
routinely hit it, and the read model already coded for it.

Also restores the point citations the 2026-07-27 pass removed while the chapter
was unverified: it is kapitel 9, not kapitel 8 (which is arkivering), verified
against BFN's consolidated text.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L3P2hr19PhQuCoTSGoegcY

* test(pg): fix two fixture bugs in the behandlingshistorik trigger tests

pg-real caught both, and neither is in the migration: the inserts fail
before the trigger is reached.

mapping_rules.rule_type is constrained to mcc_code / merchant_name /
description_pattern / amount_threshold / combined; the test used
'merchant'.

booking_template_library's btl_insert policy requires
current_user_can_write() and company_id = current_active_company_id(),
so the authenticated insert needs a company_members row and a
user_preferences.active_company_id, the same setup
booking-template-hidden.pg.test.ts uses.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L3P2hr19PhQuCoTSGoegcY

* test(pg): assert the booking-template audit row inside the user transaction

withUserContext always rolls back, so the audit row the trigger writes
is gone before an outside connection can see it. The trigger fires in
the same transaction as the write, so the assertion belongs there too.
The other cases in this file write on the pool (autocommit) and are
unaffected.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L3P2hr19PhQuCoTSGoegcY

* fix(reports): name every build id in the per-day program-version entry

Raised by the compliance review on #2097: the roll-up listed five ids
and a count, which leaves an auditor unable to reconstruct which
versions ran that day. app_releases keeps the full record, but the
report is the surface anyone actually reads. A day is bounded by the
deploy rate (~19), so the full list stays one readable cell.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01L3P2hr19PhQuCoTSGoegcY

---------

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>

supabase/migrations/20260901103000_behandlingshistorik_audit_triggers_and_app_releases.sql

@@ -0,0 +1,93 @@
+-- Behandlingshistorik, part 3 (BFL 5 kap. 11 §, BFNAR 2013:2 punkt 9.16 andra
+-- stycket): "förändringar i bokföringssystemet som påverkar bokföringsposternas
+-- behandling samt när dessa förändringar infördes". BFN's commentary names
+-- behandlingsregler (automatkonteringar, fasta procentsatser) and new program
+-- versions as the examples. Until now the rule/template tables and the
+-- statutory payroll constants changed without a trace, and software versions
+-- had no history at all.
+--
+-- 1. write_audit_log() triggers on the behandlingsregler tables and the
+--    import logs. The trigger derives user_id/company_id from the row itself
+--    (NULL company_id for the global salary_payroll_config: those rows are
+--    read through the service role by the behandlingshistorik report).
+--    categorization_templates learn on every booking (occurrence_count,
+--    confidence, last_seen_date): those telemetry-only updates are excluded
+--    the same way api_keys request counters are (20260721115701), so only
+--    rule changes (accounts, VAT, pattern, active flag) are logged.
+-- 2. app_releases: append-only log of program versions seen in production,
+--    written by the runtime the first time a build answers a request
+--    (lib/reports/app-releases.ts). Readable by every authenticated user
+--    (it is not company data), writable only by the service role.
+--
+-- pg-test: tests/pg/behandlingshistorik-audit-triggers.pg.test.ts
+
+-- ── 1. Audit triggers ─────────────────────────────────────────────────────────
+
+CREATE TRIGGER audit_mapping_rules
+  AFTER INSERT OR UPDATE OR DELETE ON public.mapping_rules
+  FOR EACH ROW EXECUTE FUNCTION public.write_audit_log();
+
+CREATE TRIGGER audit_booking_template_library
+  AFTER INSERT OR UPDATE OR DELETE ON public.booking_template_library
+  FOR EACH ROW EXECUTE FUNCTION public.write_audit_log();
+
+CREATE TRIGGER audit_categorization_templates
+  AFTER INSERT OR DELETE ON public.categorization_templates
+  FOR EACH ROW EXECUTE FUNCTION public.write_audit_log();
+
+CREATE TRIGGER audit_categorization_templates_update
+  AFTER UPDATE ON public.categorization_templates
+  FOR EACH ROW
+  WHEN (
+    (to_jsonb(OLD) - ARRAY[
+      'occurrence_count',
+      'confidence',
+      'last_seen_date',
+      'updated_at'
+    ]::text[])
+    IS DISTINCT FROM
+    (to_jsonb(NEW) - ARRAY[
+      'occurrence_count',
+      'confidence',
+      'last_seen_date',
+      'updated_at'
+    ]::text[])
+  )
+  EXECUTE FUNCTION public.write_audit_log();
+
+CREATE TRIGGER audit_salary_payroll_config
+  AFTER INSERT OR UPDATE OR DELETE ON public.salary_payroll_config
+  FOR EACH ROW EXECUTE FUNCTION public.write_audit_log();
+
+CREATE TRIGGER audit_sie_imports
+  AFTER INSERT OR UPDATE OR DELETE ON public.sie_imports
+  FOR EACH ROW EXECUTE FUNCTION public.write_audit_log();
+
+CREATE TRIGGER audit_bank_file_imports
+  AFTER INSERT OR UPDATE OR DELETE ON public.bank_file_imports
+  FOR EACH ROW EXECUTE FUNCTION public.write_audit_log();
+
+-- ── 2. Program version log ────────────────────────────────────────────────────
+
+CREATE TABLE public.app_releases (
+  version       text PRIMARY KEY,
+  first_seen_at timestamptz NOT NULL DEFAULT now(),
+  source        text NOT NULL DEFAULT 'runtime'
+);
+
+COMMENT ON TABLE public.app_releases IS
+  'Program versions (build ids) observed in production and when they were first seen. Behandlingshistorik input per BFNAR 2013:2 p. 9.16: "nya programversioner" are system changes that must be dated. Append-only; written by the runtime via the service role (lib/reports/app-releases.ts).';
+
+ALTER TABLE public.app_releases ENABLE ROW LEVEL SECURITY;
+
+-- Not company data: every signed-in user may read it (it feeds every
+-- company's behandlingshistorik). No INSERT/UPDATE/DELETE policy: only the
+-- service role writes, and the immutability trigger stops edits even there.
+CREATE POLICY app_releases_select ON public.app_releases
+  FOR SELECT TO authenticated USING (true);
+
+CREATE TRIGGER app_releases_immutable
+  BEFORE UPDATE OR DELETE ON public.app_releases
+  FOR EACH ROW EXECUTE FUNCTION public.audit_log_immutable();
+
+NOTIFY pgrst, 'reload schema';