feat: event log, pending operations, and MCP staging (#135)

* feat: event log, pending operations, and MCP staging

- Event log system: persist bus events to event_log table for external
  automation platforms. Batch insert for transaction.synced. Daily
  cleanup cron at 02:00 UTC.
- Pending operations: MCP write tools (categorize, create customer,
  create invoice) now stage to pending_operations instead of executing
  directly. Users review and commit/reject from /pending in the web UI.
- Granskning page: card-based review UI with expandable previews,
  commit/reject dialogs. Only shown in nav when pending ops exist.
- Commit route re-executes using core lib functions (no extension
  imports). Guards against stale state (double-commit, deleted entities).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* feat: stage new MCP write tools after main merge

Add staging for 4 new write tools from #133:
- mark_invoice_paid, send_invoice, mark_invoice_sent,
  match_transaction_invoice
- Expand pending_operations CHECK constraint
- Add commit executors with full execution logic
- Add UI labels and generic preview component
- Remove confirm parameter from categorize (single-call staging)
- Fix UUID in pending op title (fetch transaction description)
- Hide Granskning nav when no pending ops

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review feedback

- Fix TS build error: use `select('*, customer:customers(*)')` for
  match_transaction_invoice to avoid array type inference
- Add status guard to commitSendInvoice (prevents duplicate sends)
- Replace auth.admin.getUserById with user email from session auth
- Restore optimistic lock check in commitMatchTransactionInvoice
- Fix tool description typo: expense_software → expense_office

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

supabase/migrations/20260325120000_event_log.sql

@@ -0,0 +1,41 @@
+-- Migration: Event Log
+-- Append-only event log for external automation platform integration (n8n, Make, Zapier).
+-- Events are ephemeral delivery records with 30-day TTL, NOT compliance audit logs.
+
+-- =============================================================================
+-- 1. event_log table
+-- =============================================================================
+CREATE TABLE public.event_log (
+  sequence    BIGSERIAL PRIMARY KEY,
+  user_id     UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+  event_type  TEXT NOT NULL,
+  entity_id   UUID,
+  data        JSONB NOT NULL DEFAULT '{}',
+  created_at  TIMESTAMPTZ NOT NULL DEFAULT now()
+  -- No updated_at: append-only ephemeral delivery log
+  -- No id UUID: sequence is the PK, cursor, and dedup key
+);
+
+-- Primary polling query: WHERE user_id = X AND sequence > cursor ORDER BY sequence
+CREATE INDEX idx_event_log_user_seq ON public.event_log (user_id, sequence);
+
+-- Retention cleanup: DELETE WHERE created_at < now() - interval '30 days'
+CREATE INDEX idx_event_log_created_at ON public.event_log (created_at);
+
+-- =============================================================================
+-- 2. RLS
+-- =============================================================================
+ALTER TABLE public.event_log ENABLE ROW LEVEL SECURITY;
+
+-- Users can read their own events (browser polling)
+CREATE POLICY "event_log_select" ON public.event_log
+  FOR SELECT USING (auth.uid() = user_id);
+
+-- No INSERT/UPDATE/DELETE policies: writes via service role client
+
+-- =============================================================================
+-- 3. Immutability (update only — deletes allowed for retention cleanup)
+-- =============================================================================
+CREATE TRIGGER event_log_no_update
+  BEFORE UPDATE ON public.event_log
+  FOR EACH ROW EXECUTE FUNCTION public.audit_log_immutable();

supabase/migrations/20260325130000_pending_operations.sql

@@ -0,0 +1,48 @@
+-- Migration: Pending Operations
+-- Staging table for MCP agent write operations that require user review.
+-- Agent proposes → user reviews in web UI → commits or rejects.
+
+-- =============================================================================
+-- 1. pending_operations table
+-- =============================================================================
+CREATE TABLE public.pending_operations (
+  id              UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
+  user_id         UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+  operation_type  TEXT NOT NULL CHECK (operation_type IN (
+    'categorize_transaction', 'create_customer', 'create_invoice'
+  )),
+  status          TEXT NOT NULL DEFAULT 'pending' CHECK (status IN (
+    'pending', 'committed', 'rejected'
+  )),
+  title           TEXT NOT NULL,
+  params          JSONB NOT NULL DEFAULT '{}',
+  preview_data    JSONB NOT NULL DEFAULT '{}',
+  result_data     JSONB,
+  created_at      TIMESTAMPTZ NOT NULL DEFAULT now(),
+  resolved_at     TIMESTAMPTZ,
+  updated_at      TIMESTAMPTZ NOT NULL DEFAULT now()
+);
+
+-- Primary query: list pending ops for a user
+CREATE INDEX idx_pending_ops_user_status ON public.pending_operations (user_id, status);
+
+-- =============================================================================
+-- 2. RLS
+-- =============================================================================
+ALTER TABLE public.pending_operations ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "pending_ops_select_own" ON public.pending_operations
+  FOR SELECT USING (auth.uid() = user_id);
+
+CREATE POLICY "pending_ops_update_own" ON public.pending_operations
+  FOR UPDATE USING (auth.uid() = user_id);
+
+-- No INSERT policy: writes via service role client from MCP handler
+-- No DELETE policy: status transitions only (pending → committed/rejected)
+
+-- =============================================================================
+-- 3. updated_at trigger
+-- =============================================================================
+CREATE TRIGGER pending_operations_updated_at
+  BEFORE UPDATE ON public.pending_operations
+  FOR EACH ROW EXECUTE FUNCTION public.update_updated_at_column();

supabase/migrations/20260326120000_pending_operations_expand_types.sql

@@ -0,0 +1,16 @@
+-- Expand pending_operations operation_type to include new MCP write tools
+
+ALTER TABLE public.pending_operations
+  DROP CONSTRAINT IF EXISTS pending_operations_operation_type_check;
+
+ALTER TABLE public.pending_operations
+  ADD CONSTRAINT pending_operations_operation_type_check
+  CHECK (operation_type IN (
+    'categorize_transaction',
+    'create_customer',
+    'create_invoice',
+    'mark_invoice_paid',
+    'send_invoice',
+    'mark_invoice_sent',
+    'match_transaction_invoice'
+  ));