chore: post-bankid redirect, recapt feedback, TIC SPAR enrichment (#400)

* chore: post-bankid redirect, recapt feedback, TIC SPAR enrichment

- BankID login + register now redirect to /select-company so the picker
  shows freshly enriched CompanyRoles from the current session.
- New lib/support/submit-feedback util prefers window.recapt feedback
  widget when present, falls back to /api/support/contact. SupportLink
  uses it and hides itself in sandbox companies via new isSandbox flag
  on CompanyContext (+ useCompanyOptional hook).
- TIC enrichment re-requests SPAR alongside CompanyRoles now that both
  types are enabled on the tenant; enrichment shape logged PII-free
  (booleans/counts only). Tests cover the SPAR+CompanyRoles path.
- Skatteverket api-client: 15s AbortSignal timeout on outbound requests.
- Swedish compliance review CI: bump REVIEW_MODEL to claude-opus-4-7.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: keep compliance review model on sonnet-4-6

Reverts the opus-4-7 bump from the previous commit per request.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(tic): don't persist SPAR PII to extension_data

The previous commit started requesting SPAR alongside CompanyRoles and
wrote the full enrichment payload (incl. personnummer, full name, home
address, birth date, gender) verbatim to extension_data.value — a plain
JSON column. Personnummer is already hashed + encrypted in
bankid_identities, so the extension_data row was an unencrypted PII
duplicate exposed to anyone with read access to the table.

No consumer (middleware, /select-company, createCompanyFromTicRole)
reads any SPAR field today; they only read companyRoles. Persist a
sanitized blob of { companyRoles, enrichedAtUtc } instead. SPAR is
still requested from TIC (and its shape logged PII-free) so enrichment
completes; if address pre-fill ships later, those fields should be
encrypted before storage.

Also drop the dead `null` branch from SubmitFeedbackResult.channel —
every code path returns 'recapt' or 'email'.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/(auth)/login/page.tsx

@@ -107,7 +107,9 @@ export default function LoginPage() {
           document.cookie = 'gnubok-invite-token=; path=/; max-age=0'
         }
 
-        router.push('/')
+        // Always land on the picker after BankID login so the user sees
+        // fresh CompanyRoles fetched during this session's enrichment.
+        router.push('/select-company')
         router.refresh()
       } catch (error) {
         console.error('[login] BankID complete error', error)

app/(auth)/register/page.tsx

@@ -144,7 +144,7 @@ function RegisterPageContent() {
         return
       }
 
-      router.push('/')
+      router.push('/select-company')
       router.refresh()
     } catch (error) {
       console.error('[register] BankID signup error', error)

app/(dashboard)/layout.tsx

@@ -81,6 +81,7 @@ export default async function DashboardLayout({
           companies: [],
           isTeamMember,
           team,
+          isSandbox: false,
         }}
       >
         <CompanyTabSync />
@@ -130,6 +131,7 @@ export default async function DashboardLayout({
       })),
       isTeamMember,
       team,
+      isSandbox: false,
     }
 
     return (
@@ -179,6 +181,10 @@ export default async function DashboardLayout({
   const displayName = settings?.company_name || companyRow.name
   const companyWithName = { ...companyRow, name: displayName }
 
+  const entityType = (settings?.entity_type as EntityType) || 'enskild_firma'
+
+  const isSandbox = settings?.is_sandbox === true
+
   const companyContextValue = {
     company: companyWithName,
     role: memberRow.role as CompanyRole,
@@ -192,12 +198,9 @@ export default async function DashboardLayout({
     }),
     isTeamMember,
     team,
+    isSandbox,
   }
 
-  const entityType = (settings?.entity_type as EntityType) || 'enskild_firma'
-
-  const isSandbox = settings?.is_sandbox === true
-
   return (
     <CompanyProvider value={companyContextValue}>
       <CompanyTabSync />