Feat/cloud backup (#277)

* feat: cloud backup to Google Drive + full-archive all-scope

Adds a cloud-backup extension that uploads a full-company backup ZIP to
the user's own Google Drive via OAuth (drive.file scope only). Refresh
tokens are AES-256-GCM encrypted before being stored in extension_data.

The full-archive export gains a scope=all mode for whole-company
backups (per-period SIE under sie/, per-period rapporter/ subfolders,
flat dokument/ manifest tagged with fiscal_period_id). An 80 MB size
guard short-circuits generation before the platform response limit.

Also fixes a latent bug in lib/core/audit/audit-service.ts where the
parameter was named userId while the query filtered by company_id; the
audit-trail API route was passing user.id so audit queries returned
empty unless user and company shared a UUID.

Drive-by: scope the dashboard "fresh start" localStorage key per
companyId so dismissing the setup checklist in one company no longer
carries over to others.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: address review comments on cloud backup + archive export

- Extend audit trail to_date to end-of-day so last-day entries aren't
  silently excluded from period-scoped archives.
- Apply 413 size-limit guard regardless of include_documents, using the
  overhead-only figure when documents are excluded.
- Use crypto.randomUUID() for Drive multipart boundary to eliminate any
  collision risk with ZIP payload bytes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: migrate legacy setup-gate localStorage keys on dashboard

Users who previously dismissed the setup checklist via the old global
erp_setup_fresh_start or erp_checklist_dismissed keys were re-gated after
the switch to a company-scoped key. Fall back to the legacy keys on read
and migrate them to the scoped key on first hit.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: update customer email handling and anonymization rules in supportmail-to-ticket skill

* test: update audit trail to_date expectation for end-of-day timestamp

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

lib/extensions/_generated/enabled-extensions.ts

@@ -6,4 +6,5 @@ export const ENABLED_EXTENSION_IDS: ReadonlySet<string> = new Set([
   'arcim-migration',
   'tic',
   'mcp-server',
+  'cloud-backup',
 ])

lib/extensions/_generated/extension-list.ts

@@ -5,6 +5,7 @@ import { emailExtension } from '@/extensions/general/email'
 import { arcimMigrationExtension } from '@/extensions/general/arcim-migration'
 import { ticExtension } from '@/extensions/general/tic'
 import { mcpServerExtension } from '@/extensions/general/mcp-server'
+import { cloudBackupExtension } from '@/extensions/general/cloud-backup'
 
 export const FIRST_PARTY_EXTENSIONS: Extension[] = [
   enableBankingExtension,
@@ -12,4 +13,5 @@ export const FIRST_PARTY_EXTENSIONS: Extension[] = [
   arcimMigrationExtension,
   ticExtension,
   mcpServerExtension,
+  cloudBackupExtension,
 ]

lib/extensions/_generated/sector-definitions.ts

@@ -68,5 +68,17 @@ export const EXTENSION_DEFINITIONS: Record<string, ExtensionDefinition[]> = {
           "description": "Gör bokföring via Claude, Cursor eller annan MCP-klient",
           "longDescription": "Exponerar gnuboks bokföringsmotor som MCP-verktyg (Model Context Protocol). Koppla din MCP-klient med en API-nyckel och gör bokföring genom konversation: visa okategoriserade transaktioner, bokför dem, skapa fakturor."
     },
+    {
+          "slug": "cloud-backup",
+          "name": "Molnsynkronisering",
+          "sector": "general",
+          "category": "operations",
+          "icon": "Cloud",
+          "dataPattern": "manual",
+          "description": "Synka säkerhetsbackup till din egen molnlagring",
+          "longDescription": "Koppla ditt Google Drive-konto och ladda upp en fullständig säkerhetsbackup med ett klick. Gnubok skapar en ZIP med SIE-filer, kvitton och behandlingshistorik och laddar upp till en egen mapp i din Drive. Perfekt för att uppfylla egna krav på redundans.",
+          "hasOwnData": true,
+          "subscriptionNotice": "Kräver ett Google-konto. Uppladdningar sker direkt till din Drive — ingen data lagras hos tredje part utöver Google."
+    },
   ],
 }

lib/extensions/_generated/workspace-map.tsx

@@ -7,4 +7,5 @@ export const WORKSPACES: Record<string, ComponentType<WorkspaceComponentProps>>
   'general/enable-banking': dynamic(() => import('@/components/extensions/general/EnableBankingWorkspace')),
   'general/arcim-migration': dynamic(() => import('@/components/extensions/general/ArcimMigrationWorkspace')),
   'general/tic': dynamic(() => import('@/components/extensions/general/TicWorkspace')),
+  'general/cloud-backup': dynamic(() => import('@/components/extensions/general/CloudBackupWorkspace')),
 }