Bug/UI wrong display (#573)

* fix(dashboard): exclude credit notes from unpaid invoices widget

Credit notes (status='sent', negative total) were summed into the
"Att få betalt" widget, producing confusing negative totals like
"2 st, -38 625 kr". Filter them out via credited_invoice_id IS NULL,
matching the existing pattern in reminder-processor and the AR ledger.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(documents): harden PDF preview and upload validation

- JournalEntryAttachments: switch inline PDF preview from <iframe> to
  <object type="application/pdf">. Mirrors the AttachmentPreviewSheet
  fix from #572 — Chrome's frame pipeline intermittently surfaced
  "Det här innehållet har blockerats" on iframes even with permissive
  CSP. <object> invokes the PDF plugin directly. crbug.com/271452.

- /api/documents/:id/inline: resolve Content-Type via file extension
  when mime_type is null or application/octet-stream. Legacy uploads
  landed with empty File.type from some drag sources; combined with
  the new X-Content-Type-Options: nosniff header on this route,
  Chrome refused to render valid PDFs. Extension fallback covers
  every legacy row without a DB backfill.

- /api/documents POST: surface DB-trigger period-lock errors as a
  400 DOC_UPLOAD_PERIOD_LOCKED with a Swedish reason. Previously
  every catch was bucketed into DOC_UPLOAD_STORAGE_FAILED (500 /
  "Filen kunde inte sparas") which hid the real cause from users
  attaching to verifikationer in closed/locked fiscal periods.

- document-service: add validateDocumentMagicBytes() that inspects
  the first bytes for valid PDF/PNG/JPEG/WebP headers (PDF tolerates
  a leading UTF-8 BOM). Wired into uploadDocument() and
  createNewVersion() so every upload path is protected — UI, MCP,
  and future email/webhook ingestion. Defends against agents that
  send a base64-encoded text placeholder instead of real binary
  bytes via the gnubok_upload_document MCP tool, which produced
  tiny (15-561 byte) "PDFs" that failed to render in Chrome and
  in external viewers.

Tests use a minimal valid PDF buffer (%PDF-1.4 … %%EOF).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(arsredovisning): emit ÅRL-required notes and FTE-weighted medelantal

Five compliance gaps fixed in the K2 and K3 noter builders:

- Anläggningstillgångar roll-forward per ÅRL 5:8 § — per-category IB
  anskaffningsvärde, tillkommande, avgående, UB and accumulated
  avskrivningar movement (was only emitting avskrivningstider).
- Långfristiga skulder förfallande efter mer än fem år per ÅRL 5:13 §.
- Ställda säkerheter and Eventualförpliktelser as separate notes per
  ÅRL 5:14-15 § (K2 previously combined them).
- Koncernförhållanden per BFNAR 2016:10 kap. 19 / BFNAR 2012:1 kap. 8.

Replaces medelantal anställda — the old query filtered employees by an
is_active column that doesn't exist, so the note never emitted. Now
uses an FTE-weighted day-based average per ÅRL 5:20 §.

Six disclosure fields persist on arsredovisning_narratives as per-period
overrides; the UI extends the existing förvaltningsberättelse editor
with a "Lagstadgade upplysningar" subsection sharing the same Spara
button — no new pages, no settings changes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(invoices): respect vat_registered=false and hide personnummer for B2C

- PDF address block no longer prints org_number for individual customers
  (GDPR data minimization; ML 17 kap 24§ requires name + address only).
- Wire company_settings.vat_registered through the rule helpers, invoice
  creation API, preview-pdf API, and the new-invoice form so a non-VAT-
  registered seller cannot charge VAT (ML 1 kap. 1§). The PDF suppresses
  the empty "Moms 0%" row and shows a dedicated "Företaget är inte
  momsregistrerat" notice instead of the ML 3 kap. exempt notice.
- Engine unchanged: 'exempt' treatment already routes to 3004/3100 and
  skips VAT lines.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(settings): remove approval rules from sidebar and routes

* fix(invoices): ensure vat_registered defaults to true for invoice previews and API

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/api/documents/[id]/inline/route.ts

@@ -17,6 +17,30 @@ import { createServiceClient } from '@/lib/supabase/server'
  * (RLS + explicit company_id filter) before the service-role client
  * fetches the file from the non-public `documents` bucket.
  */
+
+const EXTENSION_MIME_MAP: Record<string, string> = {
+  pdf: 'application/pdf',
+  jpg: 'image/jpeg',
+  jpeg: 'image/jpeg',
+  png: 'image/png',
+  webp: 'image/webp',
+}
+
+/**
+ * Resolve the response Content-Type. Some legacy uploads landed with
+ * `mime_type = null` or `application/octet-stream` (browsers sometimes
+ * report empty File.type for files dragged from certain sources). Combined
+ * with the new `X-Content-Type-Options: nosniff` header on this route,
+ * that broke Chrome's PDF viewer for older rows — the plugin would load
+ * via <object type="application/pdf"> but refuse to parse a response
+ * served as octet-stream. Falling back to the file extension covers every
+ * legacy row without a DB backfill.
+ */
+function resolveContentType(fileName: string, dbMimeType: string | null): string {
+  if (dbMimeType && dbMimeType !== 'application/octet-stream') return dbMimeType
+  const ext = fileName.toLowerCase().split('.').pop() ?? ''
+  return EXTENSION_MIME_MAP[ext] ?? dbMimeType ?? 'application/octet-stream'
+}
 export async function GET(
   _request: Request,
   { params }: { params: Promise<{ id: string }> }
@@ -68,9 +92,14 @@ export async function GET(
   return new NextResponse(blob, {
     status: 200,
     headers: {
-      'Content-Type': doc.mime_type ?? 'application/octet-stream',
+      'Content-Type': resolveContentType(doc.file_name, doc.mime_type),
       'Content-Disposition': `inline; filename="${safeFileName}"`,
       'Cache-Control': 'private, max-age=300',
+      // Block MIME sniffing — Content-Type is derived from DB metadata
+      // (with extension fallback for legacy rows), never from response
+      // content. Without nosniff a tampered file_name extension could
+      // serve a stored document under an attacker-chosen MIME type.
+      'X-Content-Type-Options': 'nosniff',
     },
   })
 }

app/api/documents/route.ts

@@ -62,10 +62,19 @@ export const POST = withRouteContext(
 
       return NextResponse.json({ data: document })
     } catch (err) {
+      const message = err instanceof Error ? err.message : 'unknown'
+      // DB trigger rejects inserts whose journal_entry_id points at an entry
+      // in a closed/locked period. Surface as 400 with the real reason.
+      if (/locked\/closed fiscal period|Bokföringen är låst/i.test(message)) {
+        return errorResponseFromCode('DOC_UPLOAD_PERIOD_LOCKED', opLog, {
+          requestId,
+          details: { reason: message },
+        })
+      }
       opLog.error('document upload failed', err as Error)
       return errorResponseFromCode('DOC_UPLOAD_STORAGE_FAILED', opLog, {
         requestId,
-        details: { reason: err instanceof Error ? err.message : 'unknown' },
+        details: { reason: message },
       })
     }
   },