feat(mcp): accept article_id on gnubok_create_invoice lines (#1638)

* feat(mcp): accept article_id on gnubok_create_invoice lines

Invoice lines staged via MCP can now reference a catalog article
(artikelregister). Staging prefills description, unit, unit_price,
vat_rate and revenue account from the article with explicit-wins
semantics, mirroring the web line picker. Unknown, foreign-company and
deactivated articles are refused at staging, as is a price prefill from
an article priced in another currency. The approval executor gains a
company-scope gate for staged article_id values: the FK on
invoice_items.article_id proves existence, not tenancy.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(mcp): adopt article VAT rate only from the customer's default set

Web line picker parity (InvoiceEditor's applyArticle guard): an article's
stored vat_rate is its domestic rate. The prefill previously staged it
unconditionally, and the staging/commit gates check the wider permitted
set (which includes 25/12/6 for taxed-where-performed supplies), so
{article_id, quantity} to a validated EU business staged 25% Swedish VAT
onto a reverse-charge invoice. The customer is now fetched before the
prefill and the article rate is adopted only when it is in the
customer's default rate set; foreign-business lines fall back to the 0%
reverse-charge/export default unless the agent sets vat_rate explicitly.
Prefill logic extracted into resolveInvoiceLineFromArticle (CodeRabbit).

Found by the skeptic review pass (two independent refutations) and the
Swedish accounting compliance bot, all converging on the same defect.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(invoices): name the article VAT adoption set in vat-rules, not the MCP server

The vat-rate-gate-parity guard pins that no invoice write path mentions
getAvailableVatRates: gating on the picker default is the bug it exists
to prevent. The article-rate adoption in gnubok_create_invoice needs the
default set for a different purpose (prefill, not gating), so the
semantics move into lib/invoices/vat-rules.ts as
getArticleVatRateAdoptionSet(), with tests pinning that adoption is
empty for single-rate foreign customers and always a subset of the
permitted set. server.ts keeps gating on getPermittedVatRates.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/pending-operations/commit.ts

@@ -1554,6 +1554,26 @@ async function commitCreateInvoice(
     }
   }
 
+  // Drift/tamper gate for staged article references: the FK on
+  // invoice_items.article_id only proves the article exists, not that it
+  // belongs to THIS company, so scope-check here like revenue_account above.
+  const stagedArticleIds = Array.from(
+    new Set(items.map((i) => i.article_id).filter((a): a is string => !!a)),
+  )
+  if (stagedArticleIds.length > 0) {
+    const { data: articleRows, error: articleError } = await supabase
+      .from('articles')
+      .select('id')
+      .eq('company_id', companyId)
+      .in('id', stagedArticleIds)
+    if (articleError) return { error: articleError.message, status: 500 }
+    const foundArticleIds = new Set((articleRows ?? []).map((a: { id: string }) => a.id))
+    const missingArticleId = stagedArticleIds.find((a) => !foundArticleIds.has(a))
+    if (missingArticleId) {
+      return { error: `Artikel ${missingArticleId} finns inte i företaget`, status: 400 }
+    }
+  }
+
   const total = subtotal + vatAmount
   const currency = ((params.currency as string) || 'SEK') as Currency
   const invoiceDate = (params.invoice_date as string) || new Date().toISOString().split('T')[0]