Feat/cloud backup (#277)

* feat: cloud backup to Google Drive + full-archive all-scope

Adds a cloud-backup extension that uploads a full-company backup ZIP to
the user's own Google Drive via OAuth (drive.file scope only). Refresh
tokens are AES-256-GCM encrypted before being stored in extension_data.

The full-archive export gains a scope=all mode for whole-company
backups (per-period SIE under sie/, per-period rapporter/ subfolders,
flat dokument/ manifest tagged with fiscal_period_id). An 80 MB size
guard short-circuits generation before the platform response limit.

Also fixes a latent bug in lib/core/audit/audit-service.ts where the
parameter was named userId while the query filtered by company_id; the
audit-trail API route was passing user.id so audit queries returned
empty unless user and company shared a UUID.

Drive-by: scope the dashboard "fresh start" localStorage key per
companyId so dismissing the setup checklist in one company no longer
carries over to others.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: address review comments on cloud backup + archive export

- Extend audit trail to_date to end-of-day so last-day entries aren't
  silently excluded from period-scoped archives.
- Apply 413 size-limit guard regardless of include_documents, using the
  overhead-only figure when documents are excluded.
- Use crypto.randomUUID() for Drive multipart boundary to eliminate any
  collision risk with ZIP payload bytes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: migrate legacy setup-gate localStorage keys on dashboard

Users who previously dismissed the setup checklist via the old global
erp_setup_fresh_start or erp_checklist_dismissed keys were re-gated after
the switch to a company-scoped key. Fall back to the legacy keys on read
and migrate them to the scoped key on first hit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: update customer email handling and anonymization rules in supportmail-to-ticket skill

* test: update audit trail to_date expectation for end-of-day timestamp

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

components/dashboard/DashboardContent.tsx

@@ -24,10 +24,11 @@ import { resolveIcon } from '@/lib/extensions/icon-resolver'
 import type { QuickActionDefinition } from '@/lib/extensions/types'
 import type { CompanySettings, Deadline, ReceiptQueueSummary, OnboardingProgress } from '@/types'
 
-const SETUP_FRESH_START_KEY = 'erp_setup_fresh_start'
+const setupFreshStartKey = (companyId: string) => `erp_setup_fresh_start:${companyId}`
 
 interface DashboardContentProps {
   firstName?: string | null
+  companyId: string
   settings: CompanySettings | null
   summary: {
     ytd: { income: number; expenses: number; net: number }
@@ -49,7 +50,7 @@ interface DashboardContentProps {
   onboardingProgress?: OnboardingProgress
 }
 
-export default function DashboardContent({ firstName, settings, summary, onboardingProgress }: DashboardContentProps) {
+export default function DashboardContent({ firstName, companyId, settings, summary, onboardingProgress }: DashboardContentProps) {
   const [showAllAlerts, setShowAllAlerts] = useState(false)
   const [showMore, setShowMore] = useState(false)
   const [greeting, setGreeting] = useState('Hej')
@@ -68,16 +69,23 @@ export default function DashboardContent({ firstName, settings, summary, onboard
       setSetupGateActive(false)
       return
     }
-    const freshStart = localStorage.getItem(SETUP_FRESH_START_KEY) === 'true'
-    const oldDismissed = localStorage.getItem('erp_checklist_dismissed') === 'true'
-    if (freshStart || oldDismissed) setSetupGateActive(false)
-  }, [needsSetup])
+    const scopedKey = setupFreshStartKey(companyId)
+    const freshStart = localStorage.getItem(scopedKey) === 'true'
+    const legacyFreshStart = localStorage.getItem('erp_setup_fresh_start') === 'true'
+    const legacyDismissed = localStorage.getItem('erp_checklist_dismissed') === 'true'
+    if (freshStart || legacyFreshStart || legacyDismissed) {
+      if (!freshStart) {
+        localStorage.setItem(scopedKey, 'true')
+      }
+      setSetupGateActive(false)
+    }
+  }, [needsSetup, companyId])
 
   if (setupGateActive) {
     return (
       <NewUserChecklist
         onFreshStart={() => {
-          localStorage.setItem(SETUP_FRESH_START_KEY, 'true')
+          localStorage.setItem(setupFreshStartKey(companyId), 'true')
           setSetupGateActive(false)
         }}
       />