Bug/customer cron job (#516)

* fix(reminder-processor): filter out credited invoices in overdue reminders

* feat: implement linking of transactions to journal entries

- Added POST endpoint for linking a bank transaction to an existing journal entry without creating new bookkeeping.
- Implemented validation for required fields and error handling for various scenarios (e.g., missing journal_entry_id, transaction already linked, journal entry not found).
- Created tests for the new endpoint to cover various cases including successful linking, error responses, and invoice handling.
- Introduced duplicate payment detection logic to prevent double-booking of bank receipts.
- Added a new component for correction affordance in the UI to facilitate user corrections on journal entries.

* feat(invoice-matching): enhance force matching with expected journal entry validation

lib/api/with-route-context.ts

@@ -45,6 +45,13 @@ export interface RouteContext {
    * resolved, so handlers can treat this as guaranteed non-null. Routes that
    * need to opt out of the guarantee (e.g. onboarding) shouldn't use
    * withRouteContext.
+   *
+   * Membership invariant: `getActiveCompanyId` only returns a company the
+   * authenticated user is a current member of (it validates
+   * `company_members` and excludes archived companies). The handler may
+   * therefore treat `companyId` as "a company the caller is authorized to
+   * read", and routes that mutate state additionally enforce a non-viewer
+   * role via `requireWrite: true`. ASVS V8.2.1 / SOC 2 CC6.3.
    */
   companyId: string
 }