fix(ux): book documents directly from inbox + attach existing underlag when booking transactions (#670)

* fix(inbox): re-add Bokför manuellt on unmatched documents

Pilot feedback: a document in Dokumentinkorg could not be booked
without first matching it to a bank transaction, which is impossible
for cash expenses and other entries with no bank movement. The
backend (/items/:id/book-direct) and BookDirectlyDialog already
support standalone booking — re-expose the button in the unmatched
state. The dialog still offers optional transaction selection inside.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(transactions): pick existing inbox document when booking manually

Pilot feedback: "Bokför manuellt" from a transaction only allowed
uploading new files — an already-uploaded underlag from the inbox
could not be attached. Add a select mode to InboxDocumentPicker
(onSelect prop; journalEntryId now optional) and mount it in
TransactionBookingDialog: picked documents are linked after the
journal entry is created via /api/documents/{id}/link with
inbox_item_id, which also stamps the inbox item as consumed so it
drops out of every pending surface. Non-ok link responses now count
toward the failure toast (previously only network errors did).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(documents): address PR #670 review — stale preview dialog, JE tenancy check

Review findings:
- InboxDocumentPicker left the preview dialog floating open when a pick
  was confirmed from inside it (previewItem was never cleared before
  onClose; the component stays mounted, so the on-open reset never ran).
  Clear it in both select and link mode. (greptile)
- linkToJournalEntry verified the document's company but trusted the
  client-supplied journal_entry_id (FK only requires existence). Add an
  explicit company-scoped journal entry lookup; misses map to the
  existing DOC_LINK_ENTRY_NOT_FOUND envelope. RLS prevented any data
  leak either way — this makes the rejection explicit. New regression
  test covers the cross-tenant case. (compliance-swarm A.8.28)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

components/extensions/general/InvoiceInboxWorkspace.tsx

@@ -1630,13 +1630,12 @@ function FieldsRail({
         ) : (
           <>
             {/* Unmatched state: the canonical next step is to find the bank
-                transaction this underlag belongs to. "Skapa leverantörs-
-                faktura" stays as an escape hatch for users who want
-                supplier-invoice tracking (accrual flow). The old "Bokför
-                direkt" escape hatch was removed — its label was unclear
-                and the deterministic-book-without-bank-tx use case is
-                covered by "Matcha mot transaktion" → "Bokför manuellt"
-                (matched state). */}
+                transaction this underlag belongs to. "Bokför manuellt" opens
+                BookDirectlyDialog without a transaction — for underlag with
+                no bank movement (cash expenses, private outlays); the dialog
+                still offers optional transaction selection inside. "Skapa
+                leverantörsfaktura" stays as an escape hatch for users who
+                want supplier-invoice tracking (accrual flow). */}
             <Button
               variant="default"
               size="sm"
@@ -1645,6 +1644,14 @@ function FieldsRail({
             >
               Matcha mot transaktion
             </Button>
+            <Button
+              variant="outline"
+              size="sm"
+              className="w-full"
+              onClick={onBookDirect}
+            >
+              Bokför manuellt
+            </Button>
             <Link href={`/supplier-invoices/new?inbox_item_id=${item.id}`} className="block">
               <Button variant="outline" size="sm" className="w-full">
                 Skapa leverantörsfaktura