feat(invoices): preview invoices and underlag in the browser instead of downloading (#1228)

Reviewing an invoice or a verifikat bilaga meant saving a file and opening it
from the Downloads folder (user request, christian@odinaero.se 2026-07-25).

- GET /api/invoices/[id]/pdf accepts ?disposition=inline and serves the PDF for
  in-browser review; anything else keeps the download behaviour every existing
  caller relies on. The filename still travels in the header, so the browser
  viewer's own save action produces the same name as the download button, and
  nosniff pins the content type.
- The invoice detail page gets a "Förhandsgranska" action next to "Ladda ner
  PDF". It resolves the document through the same resolveInvoicePdfSource path
  as the download, so preview cannot become the shortcut that presents a
  re-render as the invoice the customer received: the archived delivery wins,
  a re-render is shown with its caveat, and an unreadable delivery history
  still asks instead of guessing. The archive dialog now remembers whether the
  user asked to view or to save, and its fallback does that.
- DocumentViewButton (supplier-invoice underlag, staged agent previews) points
  at the existing /api/documents/:id/inline proxy, so bilagor render in the
  browser. Navigation now happens straight from the click, so the signed-URL
  fetch and its popup-blocker workaround are gone.
- The three re-render caveat strings and the two archive-dialog descriptions
  lose their "you downloaded" wording so they stay true for both actions;
  five new keys in sv + en.

Tests: route cases for the default, inline and unknown disposition values;
invoiceRerenderUrl cases for both modes and id encoding. npm test 11364
passed, lint 0 errors. Button row screenshotted against the design system
(pill outline, Eye icon) via a temporary sandbox route.

Closes #1190

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

app/api/invoices/[id]/pdf/__tests__/route.test.ts

@@ -95,6 +95,52 @@ describe('GET /api/invoices/[id]/pdf', () => {
     expect(response.headers.get('Cache-Control')).toBe('private, no-store')
   })
 
+  it('forces a download by default', async () => {
+    enqueue({ data: invoice, error: null })
+    enqueue({ data: company, error: null })
+
+    const response = await GET(
+      createMockRequest('/api/invoices/invoice-1/pdf'),
+      createMockRouteParams({ id: 'invoice-1' }),
+    )
+
+    expect(response.headers.get('Content-Disposition')).toMatch(/^attachment;/)
+  })
+
+  it('serves the PDF inline for in-browser review on ?disposition=inline (#1190)', async () => {
+    enqueue({ data: invoice, error: null })
+    enqueue({ data: company, error: null })
+
+    const response = await GET(
+      createMockRequest('/api/invoices/invoice-1/pdf', {
+        searchParams: { disposition: 'inline' },
+      }),
+      createMockRouteParams({ id: 'invoice-1' }),
+    )
+
+    expect(response.status).toBe(200)
+    expect(response.headers.get('Content-Disposition')).toMatch(/^inline;/)
+    // The filename still travels with it, so the browser viewer's own save
+    // action produces the same name as the download button would.
+    expect(contentDispositionFilename(response.headers.get('Content-Disposition')))
+      .toBe('Oppy Sverige x Kund ÅÄÖ AB Faktura nr 2621 20260721.pdf')
+    expect(response.headers.get('X-Content-Type-Options')).toBe('nosniff')
+  })
+
+  it('keeps the download behaviour for an unknown disposition value', async () => {
+    enqueue({ data: invoice, error: null })
+    enqueue({ data: company, error: null })
+
+    const response = await GET(
+      createMockRequest('/api/invoices/invoice-1/pdf', {
+        searchParams: { disposition: 'evil' },
+      }),
+      createMockRouteParams({ id: 'invoice-1' }),
+    )
+
+    expect(response.headers.get('Content-Disposition')).toMatch(/^attachment;/)
+  })
+
   it('returns 400 before rendering when a foreign payment account is missing', async () => {
     enqueue({ data: { ...invoice, currency: 'EUR' }, error: null })
     enqueue({ data: { ...company, invoice_payment_accounts: {} }, error: null })

app/api/invoices/[id]/pdf/route.ts

@@ -15,6 +15,17 @@ import {
 
 const PRIVATE_NO_STORE_HEADERS = { 'Cache-Control': 'private, no-store' }
 
+/**
+ * `?disposition=inline` serves the PDF for in-browser review instead of forcing
+ * a download (#1190): reviewing an invoice should not mean opening a file from
+ * the Downloads folder. Anything else, including a missing or malformed value,
+ * keeps the download behaviour every existing caller relies on.
+ */
+function resolveDisposition(request: Request): 'inline' | 'attachment' {
+  const requested = new URL(request.url).searchParams.get('disposition')
+  return requested === 'inline' ? 'inline' : 'attachment'
+}
+
 function privateNoStore(response: NextResponse): NextResponse {
   response.headers.set('Cache-Control', 'private, no-store')
   return response
@@ -127,9 +138,13 @@ export const GET = withRouteContext<{ params: Promise<{ id: string }> }>(
       status: 200,
       headers: {
         'Content-Type': 'application/pdf',
-        'Content-Disposition': contentDisposition('attachment', filename),
+        'Content-Disposition': contentDisposition(resolveDisposition(request), filename),
         'Content-Length': pdfBuffer.length.toString(),
         'Cache-Control': 'private, no-store',
+        // The filename is derived from company/customer/invoice data, so the
+        // Content-Type must not be re-sniffed from the bytes when the browser
+        // renders this inline.
+        'X-Content-Type-Options': 'nosniff',
       },
     })
   } catch (error) {