Feat/cloud backup (#277)

* feat: cloud backup to Google Drive + full-archive all-scope

Adds a cloud-backup extension that uploads a full-company backup ZIP to
the user's own Google Drive via OAuth (drive.file scope only). Refresh
tokens are AES-256-GCM encrypted before being stored in extension_data.

The full-archive export gains a scope=all mode for whole-company
backups (per-period SIE under sie/, per-period rapporter/ subfolders,
flat dokument/ manifest tagged with fiscal_period_id). An 80 MB size
guard short-circuits generation before the platform response limit.

Also fixes a latent bug in lib/core/audit/audit-service.ts where the
parameter was named userId while the query filtered by company_id; the
audit-trail API route was passing user.id so audit queries returned
empty unless user and company shared a UUID.

Drive-by: scope the dashboard "fresh start" localStorage key per
companyId so dismissing the setup checklist in one company no longer
carries over to others.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: address review comments on cloud backup + archive export

- Extend audit trail to_date to end-of-day so last-day entries aren't
  silently excluded from period-scoped archives.
- Apply 413 size-limit guard regardless of include_documents, using the
  overhead-only figure when documents are excluded.
- Use crypto.randomUUID() for Drive multipart boundary to eliminate any
  collision risk with ZIP payload bytes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: migrate legacy setup-gate localStorage keys on dashboard

Users who previously dismissed the setup checklist via the old global
erp_setup_fresh_start or erp_checklist_dismissed keys were re-gated after
the switch to a company-scoped key. Fall back to the legacy keys on read
and migrate them to the scoped key on first hit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: update customer email handling and anonymization rules in supportmail-to-ticket skill

* test: update audit trail to_date expectation for end-of-day timestamp

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

components/ui/retention-notice.tsx

@@ -1,5 +1,6 @@
 'use client'
 
+import Link from 'next/link'
 import { AlertTriangle } from 'lucide-react'
 import { cn } from '@/lib/utils'
 
@@ -23,18 +24,38 @@ export function RetentionNotice({ variant, className }: RetentionNoticeProps) {
     variant === 'company'
       ? {
           title: 'Bokföringen behålls i 7 år',
-          body:
-            'Enligt bokföringslagen (BFL 7 kap. 2§) sparas räkenskapsinformation i 7 år. ' +
-            'När du raderar företaget döljs det i gnubok, men verifikationer, dokument och ' +
-            'bokföring behålls säkert tills lagkravet löpt ut.',
+          body: (
+            <>
+              Enligt bokföringslagen (BFL 7 kap. 2§) sparas räkenskapsinformation i 7 år.
+              När du raderar företaget döljs det i gnubok, men verifikationer, dokument och
+              bokföring behålls säkert tills lagkravet löpt ut. Du kan{' '}
+              <Link
+                href="/settings/backup"
+                className="underline underline-offset-2 hover:text-foreground"
+              >
+                ladda ner en säkerhetsbackup
+              </Link>{' '}
+              innan du fortsätter.
+            </>
+          ),
         }
       : {
           title: 'Kontoraderingen är permanent',
-          body:
-            'Ditt konto avidentifieras och du loggas ut från alla enheter. Räkenskaps­information ' +
-            'från företag du ägt behålls säkert i 7 år enligt BFL 7 kap. 2§. Du kan inte skapa ett ' +
-            'nytt konto med samma e-postadress — kontakta support om du vill återaktivera kontot ' +
-            'i framtiden. Ladda gärna ner ett fullständigt arkiv innan du fortsätter.',
+          body: (
+            <>
+              Ditt konto avidentifieras och du loggas ut från alla enheter.
+              Räkenskapsinformation från företag du ägt behålls säkert i 7 år enligt BFL 7
+              kap. 2§. Du kan inte skapa ett nytt konto med samma e-postadress — kontakta
+              support om du vill återaktivera kontot i framtiden. Ladda gärna ner en{' '}
+              <Link
+                href="/settings/backup"
+                className="underline underline-offset-2 hover:text-foreground"
+              >
+                säkerhetsbackup
+              </Link>{' '}
+              innan du fortsätter.
+            </>
+          ),
         }
 
   return (