feat: wire Zod validation into API routes, improve types and components

- Add 8 new Zod schemas (UpdateCustomer, UpdateSupplier, UpdateSupplierInvoice,
  UpdateAccount, BankUnlink, RunReconciliation, CorrectJournalEntry,
  EvaluateMappingRules) and wire validateBody() into 24 JSON-body API routes
- Remove redundant manual validation checks replaced by Zod
- Add comprehensive schema tests (222 tests)
- Improve type definitions in types/index.ts with expanded interfaces
- Refactor extension types (push-notifications, receipt-ocr) for cleaner imports
- Update transaction components (BatchCategorySelector, SwipeCategorizationView,
  QuickReviewDialog, VatTreatmentSelect) and invoice inbox workspace
- Add invoice-inbox utilities and type decoupling tests
- Fix NE-bilaga, SRU export, and invoice PDF template type usage
- Update CLAUDE.md with expanded architecture documentation

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/api/reconciliation/bank/link/route.ts

@@ -2,6 +2,8 @@ import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { ensureInitialized } from '@/lib/init'
 import { manualLink } from '@/lib/reconciliation/bank-reconciliation'
+import { validateBody } from '@/lib/api/validate'
+import { BankLinkSchema } from '@/lib/api/schemas'
 
 ensureInitialized()
 
@@ -13,15 +15,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
-  const body = await request.json()
-  const { transaction_id, journal_entry_id } = body
-
-  if (!transaction_id || !journal_entry_id) {
-    return NextResponse.json(
-      { error: 'transaction_id and journal_entry_id are required' },
-      { status: 400 }
-    )
-  }
+  const validation = await validateBody(request, BankLinkSchema)
+  if (!validation.success) return validation.response
+  const { transaction_id, journal_entry_id } = validation.data
 
   const result = await manualLink(supabase, user.id, transaction_id, journal_entry_id)
 

app/api/reconciliation/bank/run/route.ts

@@ -2,6 +2,8 @@ import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { ensureInitialized } from '@/lib/init'
 import { runReconciliation } from '@/lib/reconciliation/bank-reconciliation'
+import { validateBody } from '@/lib/api/validate'
+import { RunReconciliationSchema } from '@/lib/api/schemas'
 
 ensureInitialized()
 
@@ -13,8 +15,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
-  const body = await request.json()
-  const { date_from, date_to, dry_run } = body
+  const validation = await validateBody(request, RunReconciliationSchema)
+  if (!validation.success) return validation.response
+  const { date_from, date_to, dry_run } = validation.data
 
   const result = await runReconciliation(supabase, user.id, {
     dateFrom: date_from,

app/api/reconciliation/bank/unlink/route.ts

@@ -1,6 +1,8 @@
 import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { unlinkReconciliation } from '@/lib/reconciliation/bank-reconciliation'
+import { validateBody } from '@/lib/api/validate'
+import { BankUnlinkSchema } from '@/lib/api/schemas'
 
 export async function POST(request: Request) {
   const supabase = await createClient()
@@ -10,15 +12,9 @@ export async function POST(request: Request) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
-  const body = await request.json()
-  const { transaction_id } = body
-
-  if (!transaction_id) {
-    return NextResponse.json(
-      { error: 'transaction_id is required' },
-      { status: 400 }
-    )
-  }
+  const validation = await validateBody(request, BankUnlinkSchema)
+  if (!validation.success) return validation.response
+  const { transaction_id } = validation.data
 
   const result = await unlinkReconciliation(supabase, user.id, transaction_id)