Fix/dependabot cus feedback (#946)

* feat(bookkeeping): per-account default VAT, oresavrundning momsfri

Add a per-account "Standard moms" setting to the chart of accounts and use
it to auto-fill the moms on a leverantorsfaktura-rad when that konto is
picked. Oresavrundning (3740) ships as "Ingen moms", so a rounding line no
longer inherits the 25 % rad-default and skews the moms.

- chart_of_accounts.default_vat_rate (0/0.06/0.12/0.25, CHECK-constrained)
- BEFORE INSERT trigger ships 3740 momsfri on every insert path; backfills
  existing 3740 rows
- kontoplan editor: dead free-text momskod replaced with a Standard moms select
- supplier-invoice rad auto-fills the rate from the konto default

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(supplier-invoices): configurable start number for the ankomstnummer series

Add a company_settings.next_arrival_number start floor so a company can continue its leverantorsfaktura numbering from a previous system (e.g. Fortnox) instead of restarting the ankomstnummer at 1. get_next_arrival_number now floors the series via GREATEST(MAX(arrival_number)+1, next_arrival_number), so the floor can never move the series backwards or collide with the (company_id, arrival_number) unique index.

The RPC is hardened while rewritten: SET search_path to empty, schema-qualified refs, and an auth.uid() membership check matching generate_invoice_number.

Includes the settings UI field, sv/en strings, migration, and pg-real coverage. The CompanySettings type and Zod schema field for this feature landed earlier in 1bf3b641 (swept into the per-account VAT commit).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(dependabot): reduce open pull requests limit and group updates for better management

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

app/api/bookkeeping/accounts/__tests__/accounts.test.ts

@@ -131,6 +131,29 @@ describe('POST /api/bookkeeping/accounts', () => {
     expect(status).toBe(409)
     expect(body.error).toContain('5010')
   })
+
+  it('forwards default_vat_rate into the insert', async () => {
+    const { supabase, calls } = createCapturingSupabase([
+      { data: { account_number: '3740', default_vat_rate: 0 } },
+    ])
+    auth(supabase)
+    const req = createMockRequest('/api/bookkeeping/accounts', {
+      method: 'POST',
+      body: {
+        account_number: '3740',
+        account_name: 'Öres- och kronutjämning',
+        account_type: 'revenue',
+        normal_balance: 'debit',
+        default_vat_rate: 0,
+      },
+    })
+    const { status } = await parseJsonResponse(await createPOST(req, routeParams))
+    expect(status).toBe(200)
+    const insertArg = calls.find((c) => c.method === 'insert')?.args[0] as {
+      default_vat_rate?: number | null
+    }
+    expect(insertArg?.default_vat_rate).toBe(0)
+  })
 })
 
 describe('DELETE /api/bookkeeping/accounts/[number]', () => {
@@ -218,6 +241,25 @@ describe('PUT /api/bookkeeping/accounts/[number]', () => {
     expect(status).toBe(200)
     expect(body.data.account_name).toBe('Nytt namn')
   })
+
+  it('forwards default_vat_rate into the update', async () => {
+    const { supabase, calls } = createCapturingSupabase([
+      { data: { account_number: '3740', default_vat_rate: 0 } },
+    ])
+    auth(supabase)
+    const req = createMockRequest('/api/bookkeeping/accounts/3740', {
+      method: 'PUT',
+      body: { default_vat_rate: 0 },
+    })
+    const { status } = await parseJsonResponse(
+      await PUT(req, { params: Promise.resolve({ number: '3740' }) })
+    )
+    expect(status).toBe(200)
+    const updateArg = calls.find((c) => c.method === 'update')?.args[0] as {
+      default_vat_rate?: number | null
+    }
+    expect(updateArg?.default_vat_rate).toBe(0)
+  })
 })
 
 describe('POST /api/bookkeeping/accounts/activate', () => {

app/api/bookkeeping/accounts/route.ts

@@ -79,6 +79,7 @@ export const POST = withRouteContext(
         is_system_account: false,
         description: body.description || null,
         default_vat_code: body.default_vat_code || null,
+        default_vat_rate: body.default_vat_rate ?? null,
         sru_code: body.sru_code || null,
         sort_order: parseInt(body.account_number),
       })