feat: complete multi-tenant refactor + settings validation + fiscal period API (#156)

* feat: complete multi-tenant refactor for reconciliation, arcim, settings validation

- Migrate bank-reconciliation to company_id (all functions + tests)
- Migrate arcim-migration entity mappers and orchestrator to company_id
- Fix enable-banking reconciliation calls to use companyId
- Add Swedish law validation to settings schema:
  - VAT number required when VAT-registered (ML 11 kap. 8§)
  - Moms period required when VAT-registered (SFL 26 kap.)
  - Aktiebolag must use accrual accounting (BFNAR 2006:1)
- Fix fiscal year period creation: always 12 months after first year (BFL 3 kap.)
- Add plusgiro, website, pays_salaries fields to CompanySettings
- Add plusgiro to invoice PDF template
- Add fiscal period CRUD and opening balances API routes
- Add frame-src CSP directive for future iframe embedding
- Fix unlinked_1930_lines RPC to use company_id parameter
- Update CLAUDE.md documentation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review findings (P1 + P2)

- Fix reconciliation events emitting companyId as userId — thread
  actual userId through runReconciliation and manualLink
- Move VAT cross-field validation (vat_number, moms_period) from
  schema refinements to route handler where effective stored state
  is available, preventing false rejection on partial updates
- Add plusgiro format validation regex (N-N pattern)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

supabase/migrations/20260401000000_add_pays_salaries_column.sql

@@ -0,0 +1,4 @@
+-- Add pays_salaries column to company_settings
+-- Required by tax deadline logic (arbetsgivardeklaration for aktiebolag)
+ALTER TABLE public.company_settings
+  ADD COLUMN IF NOT EXISTS pays_salaries boolean NOT NULL DEFAULT false;

supabase/migrations/20260401100000_fix_unlinked_1930_lines_company_id.sql

@@ -0,0 +1,54 @@
+-- Fix get_unlinked_1930_lines to filter by company_id instead of user_id
+-- The multi-tenant migration (20260330130000) added company_id to journal_entries
+-- and transactions, but this RPC was not updated.
+
+DROP FUNCTION IF EXISTS public.get_unlinked_1930_lines(uuid, date, date);
+
+CREATE FUNCTION public.get_unlinked_1930_lines(
+  p_company_id UUID,
+  p_date_from DATE DEFAULT NULL,
+  p_date_to DATE DEFAULT NULL
+)
+RETURNS TABLE (
+  line_id UUID,
+  journal_entry_id UUID,
+  debit_amount NUMERIC,
+  credit_amount NUMERIC,
+  line_description TEXT,
+  entry_date DATE,
+  voucher_number INT,
+  voucher_series TEXT,
+  entry_description TEXT,
+  source_type TEXT
+)
+LANGUAGE sql
+STABLE
+SECURITY DEFINER
+SET search_path = public
+AS $$
+  SELECT
+    jel.id AS line_id,
+    je.id AS journal_entry_id,
+    jel.debit_amount,
+    jel.credit_amount,
+    jel.line_description,
+    je.entry_date,
+    je.voucher_number,
+    je.voucher_series,
+    je.description AS entry_description,
+    je.source_type
+  FROM public.journal_entry_lines jel
+  JOIN public.journal_entries je ON je.id = jel.journal_entry_id
+  WHERE jel.account_number = '1930'
+    AND je.company_id = p_company_id
+    AND je.status = 'posted'
+    AND (p_date_from IS NULL OR je.entry_date >= p_date_from)
+    AND (p_date_to IS NULL OR je.entry_date <= p_date_to)
+    AND NOT EXISTS (
+      SELECT 1
+      FROM public.transactions t
+      WHERE t.journal_entry_id = je.id
+        AND t.company_id = p_company_id
+    )
+  ORDER BY je.entry_date, je.voucher_number;
+$$;