fix(skatteverket): skattekonto-OCR is 13 digits, and the AGI panel stops guessing that you have not signed (#1888)

* fix(skatteverket): skattekonto-OCR is 13 digits, and the AGI panel stops guessing that you have not signed

Two reports from the same salary run (Fabian, Specific AI Sweden AB).

1. The payment file carried an OCR Skatteverket does not accept.
   generateSkattekontoOcr built the reference from the TEN-digit org number
   plus a Luhn check digit (11 digits). Skatteverket's reference is the
   TWELVE-digit identity plus a check digit: an organisationsnummer carries
   the "16" prefix, a personnummer its century. For 559547-0021 we emitted
   55954700211 where Skatteverket prints 1655954700217.

   The twelve-digit form is the same "redovisare" identity the AGI and moms
   APIs take, so it now goes through the shared toRedovisare12 converter
   instead of a second local rule: the payment file and the declaration it
   pays must not disagree about who the taxpayer is. That needs the entity
   type, which the route now reads alongside org_number.

   The route also prefers saldo.ocrNummer from the cached skattekonto
   snapshot over the derived value. It is Skatteverket's own answer for the
   account we actually sync, it covers identities the converter has no rule
   for (samordningsnummer, GD-nummer), and it covers the companies whose
   companies.org_number has drifted from company_settings.org_number.

2. AGI status stayed on "väntar på BankID-signatur i Mina Sidor" after the
   user had signed.
   Reading the kvittens needs a live Skatteverket session, and the personal
   token lives ~65 minutes, so by the time anyone signs in Mina Sidor the
   2-hourly kvittens cron finds a dead token and skips quietly. The panel
   kept asserting a state it could no longer observe.

   It now says so instead, and the reconnect action already on the panel is
   the fix: runPostConnectRefresh reconciles pending declarations on a fresh
   consent. sessionExpiredStatus also counts the needs_reconsent health flag,
   which a cron can set while the access token is still inside its hour;
   without it the panel reported a dead connection as healthy.

   Background reconciliation without a reconnect needs the läsombud grant,
   which is a registration decision and not part of this change.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs(skatteverket): say why the entity_type collapse in the payment-file route is total

companies.entity_type is NOT NULL with CHECK IN ('enskild_firma',
'aktiebolag'), so the ternary cannot silently mis-tag an enskild firma as
a legal entity and give a personnummer the "16" prefix. Two review bots
read it as an unguarded default; write down the constraint that makes it
safe instead of leaving the next reader to re-derive it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* docs(decisions): record why the cached skattekonto OCR needs no freshness gate

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

components/salary/AGIPanel.tsx

@@ -63,6 +63,8 @@ interface ConnectionStatus {
   connected: boolean
   expired?: boolean
   canRefresh?: boolean
+  /** Persisted health flag: a cron hit a terminal auth state on this token. */
+  needsReconsent?: boolean
   scope?: string
   expiresAt?: string
 }
@@ -253,7 +255,8 @@ export function AGIPanel(props: AGIPanelProps) {
         // place even though the token is now fresh. This wipes the error
         // only when (a) there's currently an error and (b) the new status
         // says we're healthy: never silently swallowing unrelated errors.
-        const isHealthy = next.connected && !next.expired && next.canRefresh !== false
+        const isHealthy =
+          next.connected && !next.expired && next.canRefresh !== false && !next.needsReconsent
         if (isHealthy) {
           setError(prev =>
             prev && /sessionen har gått ut|logga in med bankid igen/i.test(prev)
@@ -917,10 +920,14 @@ export function AGIPanel(props: AGIPanelProps) {
     grantedScopes !== null && !missingAgdScope && !grantedScopes.includes('agdredovisningperiod')
 
   // Expired session: the token row exists (so status.connected is true) but
-  // the access token is past expiry and either has no refresh token or has
-  // burned through its 10-refresh budget. The only fix is a fresh BankID
-  // round-trip.
-  const sessionExpiredStatus = status?.expired === true || status?.canRefresh === false
+  // the access token is past expiry, has no refresh token or has burned
+  // through its 10-refresh budget, or a cron already parked it as
+  // needs_reconsent. The only fix is a fresh BankID round-trip. The
+  // needs_reconsent flag has to count on its own: it is set on terminal auth
+  // errors that can land while the access token is still inside its hour, and
+  // without it the panel reports a dead connection as healthy.
+  const sessionExpiredStatus =
+    status?.expired === true || status?.canRefresh === false || status?.needsReconsent === true
 
   // One attention sentence per section (convention 6). The expired session
   // outranks the missing inlämning scope: nothing can be filed until the
@@ -1089,7 +1096,9 @@ export function AGIPanel(props: AGIPanelProps) {
               awaitingSigning
                 ? draftIsStale
                   ? t('pending_stale_draft')
-                  : t('pending_awaiting_signature')
+                  : sessionExpiredStatus
+                    ? t('pending_signature_unverifiable')
+                    : t('pending_awaiting_signature')
                 : underlagSubmitted
                   ? t('pending_underlag_submitted')
                   : t('pending_not_submitted')