Fix/m sprint fixes (#613)

* fix(dashboard): exclude ignored and already-triaged transactions from stale count

The "Gamla transaktioner" widget counted transactions that had been ignored
or already marked as is_business=true but not yet booked, so users saw a
nag for a row they had already dealt with — and the /transactions inbox
correctly hid it. Align the count with the inbox criterion (is_business
IS NULL, is_ignored = false) so the widget clears when the row leaves
the inbox.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(transactions): read entity_type from settings response wrapper

The transactions page read entityRes.entity_type directly, but
/api/settings returns { data: { entity_type, ... } }. The expression
was always undefined, so setEntityType never fired and entityType
stayed at its initial 'enskild_firma'. The template picker's
entity_type filter then dropped every aktiebolag-tagged user template
for AB customers — only entity_type='all' templates made it through.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* stale templates
bank sync
journal entry from transaction

* fixed pr comments

* fixed pr comment

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/api/salary/runs/[id]/employees/[employeeId]/route.ts

@@ -5,6 +5,7 @@ import { requireCompanyId } from '@/lib/company/context'
 import { requireWritePermission } from '@/lib/auth/require-write'
 import { validateBody } from '@/lib/api/validate'
 import { SalaryEmployeeOverrideSchema } from '@/lib/api/schemas'
+import { decryptPersonnummer, maskPersonnummer } from '@/lib/salary/personnummer'
 
 ensureInitialized()
 
@@ -35,7 +36,20 @@ export async function GET(
     return NextResponse.json({ error: 'Anställd hittades inte i lönekörningen' }, { status: 404 })
   }
 
-  return NextResponse.json({ data })
+  // Strip the encrypted personnummer ciphertext before sending to the browser
+  // — replace it with the YYYYMMDD-XXXX masked form so the page can render
+  // identity without exposing the suffix or the raw cipher blob.
+  const masked = {
+    ...data,
+    employee: data.employee
+      ? {
+          ...data.employee,
+          personnummer: maskPersonnummer(decryptPersonnummer(data.employee.personnummer)),
+        }
+      : data.employee,
+  }
+
+  return NextResponse.json({ data: masked })
 }
 
 /**