Feat/cloud backup (#277)

* feat: cloud backup to Google Drive + full-archive all-scope

Adds a cloud-backup extension that uploads a full-company backup ZIP to
the user's own Google Drive via OAuth (drive.file scope only). Refresh
tokens are AES-256-GCM encrypted before being stored in extension_data.

The full-archive export gains a scope=all mode for whole-company
backups (per-period SIE under sie/, per-period rapporter/ subfolders,
flat dokument/ manifest tagged with fiscal_period_id). An 80 MB size
guard short-circuits generation before the platform response limit.

Also fixes a latent bug in lib/core/audit/audit-service.ts where the
parameter was named userId while the query filtered by company_id; the
audit-trail API route was passing user.id so audit queries returned
empty unless user and company shared a UUID.

Drive-by: scope the dashboard "fresh start" localStorage key per
companyId so dismissing the setup checklist in one company no longer
carries over to others.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: address review comments on cloud backup + archive export

- Extend audit trail to_date to end-of-day so last-day entries aren't
  silently excluded from period-scoped archives.
- Apply 413 size-limit guard regardless of include_documents, using the
  overhead-only figure when documents are excluded.
- Use crypto.randomUUID() for Drive multipart boundary to eliminate any
  collision risk with ZIP payload bytes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: migrate legacy setup-gate localStorage keys on dashboard

Users who previously dismissed the setup checklist via the old global
erp_setup_fresh_start or erp_checklist_dismissed keys were re-gated after
the switch to a company-scoped key. Fall back to the legacy keys on read
and migrate them to the scoped key on first hit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: update customer email handling and anonymization rules in supportmail-to-ticket skill

* test: update audit trail to_date expectation for end-of-day timestamp

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

components/extensions/general/CloudBackupWorkspace.tsx

@@ -0,0 +1,25 @@
+'use client'
+
+import type { WorkspaceComponentProps } from '@/lib/extensions/workspace-registry'
+import { Button } from '@/components/ui/button'
+import { Cloud, Settings } from 'lucide-react'
+import Link from 'next/link'
+
+export default function CloudBackupWorkspace(_props: WorkspaceComponentProps) {
+  return (
+    <div className="flex flex-col items-center justify-center py-16 text-center">
+      <Cloud className="h-12 w-12 text-muted-foreground/40 mb-4" />
+      <h3 className="text-lg font-medium text-foreground">Molnsynkronisering</h3>
+      <p className="text-sm text-muted-foreground mt-1 max-w-md">
+        Koppla ditt Google Drive-konto under Säkerhetsbackup för att synka arkiv till din
+        egen molnlagring.
+      </p>
+      <Button asChild variant="outline" className="mt-4">
+        <Link href="/settings/backup">
+          <Settings className="mr-2 h-4 w-4" />
+          Gå till säkerhetsbackup
+        </Link>
+      </Button>
+    </div>
+  )
+}