feat: complete multi-tenant refactor + settings validation + fiscal period API (#156)

* feat: complete multi-tenant refactor for reconciliation, arcim, settings validation

- Migrate bank-reconciliation to company_id (all functions + tests)
- Migrate arcim-migration entity mappers and orchestrator to company_id
- Fix enable-banking reconciliation calls to use companyId
- Add Swedish law validation to settings schema:
  - VAT number required when VAT-registered (ML 11 kap. 8§)
  - Moms period required when VAT-registered (SFL 26 kap.)
  - Aktiebolag must use accrual accounting (BFNAR 2006:1)
- Fix fiscal year period creation: always 12 months after first year (BFL 3 kap.)
- Add plusgiro, website, pays_salaries fields to CompanySettings
- Add plusgiro to invoice PDF template
- Add fiscal period CRUD and opening balances API routes
- Add frame-src CSP directive for future iframe embedding
- Fix unlinked_1930_lines RPC to use company_id parameter
- Update CLAUDE.md documentation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review findings (P1 + P2)

- Fix reconciliation events emitting companyId as userId — thread
  actual userId through runReconciliation and manualLink
- Move VAT cross-field validation (vat_number, moms_period) from
  schema refinements to route handler where effective stored state
  is available, preventing false rejection on partial updates
- Add plusgiro format validation regex (N-N pattern)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

lib/api/__tests__/schemas.test.ts

@@ -1004,7 +1004,47 @@ describe('UpdateSettingsSchema', () => {
   it('accepts partial update', () => {
     const result = UpdateSettingsSchema.safeParse({
       company_name: 'My AB',
+    })
+    expect(result.success).toBe(true)
+  })
+
+  it('accepts vat_registered: true with required vat_number and moms_period', () => {
+    const result = UpdateSettingsSchema.safeParse({
       vat_registered: true,
+      vat_number: 'SE556123456701',
+      moms_period: 'quarterly',
+    })
+    expect(result.success).toBe(true)
+  })
+
+  it('accepts vat_registered: true without vat_number at schema level (route-level check uses effective state)', () => {
+    const result = UpdateSettingsSchema.safeParse({
+      vat_registered: true,
+      moms_period: 'quarterly',
+    })
+    expect(result.success).toBe(true)
+  })
+
+  it('accepts vat_registered: true without moms_period at schema level (route-level check uses effective state)', () => {
+    const result = UpdateSettingsSchema.safeParse({
+      vat_registered: true,
+      vat_number: 'SE556123456701',
+    })
+    expect(result.success).toBe(true)
+  })
+
+  it('rejects aktiebolag with kontantmetoden (BFNAR 2006:1)', () => {
+    const result = UpdateSettingsSchema.safeParse({
+      entity_type: 'aktiebolag',
+      accounting_method: 'cash',
+    })
+    expect(result.success).toBe(false)
+  })
+
+  it('allows enskild firma with kontantmetoden', () => {
+    const result = UpdateSettingsSchema.safeParse({
+      entity_type: 'enskild_firma',
+      accounting_method: 'cash',
     })
     expect(result.success).toBe(true)
   })

lib/api/schemas.ts

@@ -366,7 +366,7 @@ export const UpdateSettingsSchema = z.object({
   country: z.string().optional(),
   f_skatt: z.boolean().optional(),
   vat_registered: z.boolean().optional(),
-  vat_number: z.string().optional(),
+  vat_number: z.string().regex(/^SE\d{12}$/, 'Momsregistreringsnummer måste vara SE följt av 12 siffror').nullable().optional(),
   moms_period: MomsPeriodSchema.nullable().optional(),
   fiscal_year_start_month: z.number().int().min(1).max(12).optional(),
   preliminary_tax_monthly: z.number().nullable().optional(),
@@ -374,6 +374,7 @@ export const UpdateSettingsSchema = z.object({
   clearing_number: z.string().regex(/^\d{4,5}$/, 'Clearingnummer måste vara 4-5 siffror').optional().or(z.literal('')),
   account_number: z.string().regex(/^\d{6,12}$/, 'Kontonummer måste vara 6-12 siffror').optional().or(z.literal('')),
   bankgiro: z.string().regex(/^(\d{3,4}-\d{4}|\d{7,8})$/, 'Ogiltigt bankgironummer (7-8 siffror)').nullable().optional().or(z.literal('')),
+  plusgiro: z.string().regex(/^\d{1,7}-\d{1}$/, 'Ogiltigt plusgironummer').nullable().optional().or(z.literal('')),
   iban: z.string().optional(),
   bic: z.string().optional(),
   accounting_method: AccountingMethodSchema.optional(),
@@ -381,7 +382,9 @@ export const UpdateSettingsSchema = z.object({
   next_invoice_number: z.number().int().positive().optional(),
   invoice_default_days: z.number().int().positive().optional(),
   invoice_default_notes: z.string().nullable().optional(),
+  phone: z.string().optional(),
   email: z.string().email().optional(),
+  website: z.string().optional().or(z.literal('')),
   pays_salaries: z.boolean().optional(),
   sector_slug: z.string().nullable().optional(),
 }).refine(
@@ -396,6 +399,18 @@ export const UpdateSettingsSchema = z.object({
     message: 'Enskild firma must have fiscal year starting in January (BFL 3 kap.)',
     path: ['fiscal_year_start_month'],
   }
+).refine(
+  (data) => {
+    // BFNAR 2006:1: Aktiebolag must use accrual accounting (faktureringsmetoden)
+    if (data.entity_type === 'aktiebolag' && data.accounting_method !== undefined) {
+      return data.accounting_method === 'accrual'
+    }
+    return true
+  },
+  {
+    message: 'Aktiebolag måste använda faktureringsmetoden (BFNAR 2006:1)',
+    path: ['accounting_method'],
+  }
 )
 
 // ============================================================