Feat/cloud backup (#277)

* feat: cloud backup to Google Drive + full-archive all-scope

Adds a cloud-backup extension that uploads a full-company backup ZIP to
the user's own Google Drive via OAuth (drive.file scope only). Refresh
tokens are AES-256-GCM encrypted before being stored in extension_data.

The full-archive export gains a scope=all mode for whole-company
backups (per-period SIE under sie/, per-period rapporter/ subfolders,
flat dokument/ manifest tagged with fiscal_period_id). An 80 MB size
guard short-circuits generation before the platform response limit.

Also fixes a latent bug in lib/core/audit/audit-service.ts where the
parameter was named userId while the query filtered by company_id; the
audit-trail API route was passing user.id so audit queries returned
empty unless user and company shared a UUID.

Drive-by: scope the dashboard "fresh start" localStorage key per
companyId so dismissing the setup checklist in one company no longer
carries over to others.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: address review comments on cloud backup + archive export

- Extend audit trail to_date to end-of-day so last-day entries aren't
  silently excluded from period-scoped archives.
- Apply 413 size-limit guard regardless of include_documents, using the
  overhead-only figure when documents are excluded.
- Use crypto.randomUUID() for Drive multipart boundary to eliminate any
  collision risk with ZIP payload bytes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: migrate legacy setup-gate localStorage keys on dashboard

Users who previously dismissed the setup checklist via the old global
erp_setup_fresh_start or erp_checklist_dismissed keys were re-gated after
the switch to a company-scoped key. Fall back to the legacy keys on read
and migrate them to the scoped key on first hit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: update customer email handling and anonymization rules in supportmail-to-ticket skill

* test: update audit trail to_date expectation for end-of-day timestamp

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/api/audit-trail/__tests__/route.test.ts

@@ -63,7 +63,7 @@ describe('GET /api/audit-trail', () => {
     expect(body.count).toBe(2)
     expect(mockGetAuditLog).toHaveBeenCalledWith(
       expect.anything(),
-      'user-1',
+      'company-1',
       expect.objectContaining({})
     )
   })
@@ -88,7 +88,7 @@ describe('GET /api/audit-trail', () => {
 
     expect(mockGetAuditLog).toHaveBeenCalledWith(
       expect.anything(),
-      'user-1',
+      'company-1',
       {
         action: 'INSERT',
         table_name: 'journal_entries',

app/api/audit-trail/route.ts

@@ -27,7 +27,7 @@ export async function GET(request: Request) {
   }
 
   try {
-    const result = await getAuditLog(supabase, user.id, filters)
+    const result = await getAuditLog(supabase, companyId, filters)
     return NextResponse.json({ data: result.data, count: result.count })
   } catch (err) {
     return NextResponse.json(