Feat/cloud backup (#277)

* feat: cloud backup to Google Drive + full-archive all-scope

Adds a cloud-backup extension that uploads a full-company backup ZIP to
the user's own Google Drive via OAuth (drive.file scope only). Refresh
tokens are AES-256-GCM encrypted before being stored in extension_data.

The full-archive export gains a scope=all mode for whole-company
backups (per-period SIE under sie/, per-period rapporter/ subfolders,
flat dokument/ manifest tagged with fiscal_period_id). An 80 MB size
guard short-circuits generation before the platform response limit.

Also fixes a latent bug in lib/core/audit/audit-service.ts where the
parameter was named userId while the query filtered by company_id; the
audit-trail API route was passing user.id so audit queries returned
empty unless user and company shared a UUID.

Drive-by: scope the dashboard "fresh start" localStorage key per
companyId so dismissing the setup checklist in one company no longer
carries over to others.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: address review comments on cloud backup + archive export

- Extend audit trail to_date to end-of-day so last-day entries aren't
  silently excluded from period-scoped archives.
- Apply 413 size-limit guard regardless of include_documents, using the
  overhead-only figure when documents are excluded.
- Use crypto.randomUUID() for Drive multipart boundary to eliminate any
  collision risk with ZIP payload bytes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: migrate legacy setup-gate localStorage keys on dashboard

Users who previously dismissed the setup checklist via the old global
erp_setup_fresh_start or erp_checklist_dismissed keys were re-gated after
the switch to a company-scoped key. Fall back to the legacy keys on read
and migrate them to the scoped key on first hit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: update customer email handling and anonymization rules in supportmail-to-ticket skill

* test: update audit trail to_date expectation for end-of-day timestamp

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

lib/core/audit/audit-service.ts

@@ -19,11 +19,11 @@ export interface AuditLogFilters {
 }
 
 /**
- * Get paginated audit log entries for a user
+ * Get paginated audit log entries for a company
  */
 export async function getAuditLog(
   supabase: SupabaseClient,
-  userId: string,
+  companyId: string,
   filters: AuditLogFilters = {}
 ): Promise<{ data: AuditLogEntry[]; count: number }> {
   const page = filters.page ?? 1
@@ -33,7 +33,7 @@ export async function getAuditLog(
   let query = supabase
     .from('audit_log')
     .select('*', { count: 'exact' })
-    .eq('company_id', userId)
+    .eq('company_id', companyId)
     .order('created_at', { ascending: false })
     .range(offset, offset + pageSize - 1)
 
@@ -70,7 +70,7 @@ export async function getAuditLog(
  */
 export async function getEntityHistory(
   supabase: SupabaseClient,
-  userId: string,
+  companyId: string,
   tableName: string,
   recordId: string
 ): Promise<AuditLogEntry[]> {
@@ -78,7 +78,7 @@ export async function getEntityHistory(
   const { data, error } = await supabase
     .from('audit_log')
     .select('*')
-    .eq('company_id', userId)
+    .eq('company_id', companyId)
     .eq('table_name', tableName)
     .eq('record_id', recordId)
     .order('created_at', { ascending: true })
@@ -96,7 +96,7 @@ export async function getEntityHistory(
  */
 export async function getCorrectionChain(
   supabase: SupabaseClient,
-  userId: string,
+  companyId: string,
   journalEntryId: string
 ): Promise<AuditLogEntry[]> {
 
@@ -105,7 +105,7 @@ export async function getCorrectionChain(
     .from('journal_entries')
     .select('id, reverses_id, reversed_by_id, correction_of_id')
     .eq('id', journalEntryId)
-    .eq('company_id', userId)
+    .eq('company_id', companyId)
     .single()
 
   if (entryError || !entry) {
@@ -122,7 +122,7 @@ export async function getCorrectionChain(
   const { data: referencing } = await supabase
     .from('journal_entries')
     .select('id')
-    .eq('company_id', userId)
+    .eq('company_id', companyId)
     .or(`reverses_id.eq.${journalEntryId},reversed_by_id.eq.${journalEntryId},correction_of_id.eq.${journalEntryId}`)
 
   for (const ref of referencing || []) {
@@ -133,7 +133,7 @@ export async function getCorrectionChain(
   const { data, error } = await supabase
     .from('audit_log')
     .select('*')
-    .eq('company_id', userId)
+    .eq('company_id', companyId)
     .eq('table_name', 'journal_entries')
     .in('record_id', Array.from(relatedIds))
     .order('created_at', { ascending: true })