fix(sandbox): lock what the sandbox cannot actually do (#1318)

* fix(sandbox): lock what the sandbox cannot actually do

Three surfaces in the sandbox advertised capability the sandbox blocks
outright, or rendered a staged preview wrong.

Skatteverket promo card: hidden for sandbox companies. The sandbox landing
page tells users Skatteverket is off, and the authorize route 403s via
guardSandbox, so the dashboard nudge was a dead end. Same precedent as
TaxSettingsContent, which already hides its Skatteverket section on
is_sandbox.

Dokumentinkorg: locked with a state that says what the workspace does and
sends the user to registration. Checked before the capability gate on
purpose: the seed_trial trigger grants every new company (sandbox
included) 30 days of every paid capability, so the existing paywall waved
a demo company straight through. The CTA signs the anonymous session out
first, mirroring SandboxBanner.

Staged categorize_transaction preview: the seed wrote its kontering under
the generic preview_lines key, but categorize_transaction is the one type
with a dedicated preview component, and it reads `lines`. The card fell
through to its legacy summary branch and rendered blank Debetkonto and
Kreditkonto plus "NaN kr" from formatCurrency(undefined). The seeded blob
now mirrors what gnubok_categorize_transaction stages, extracted into
buildSandboxPendingOperations so both shapes are unit-testable.
CategorizePreview also learns to read preview_lines and to show a missing
amount as a gap, so a live 24h sandbox stops showing NaN before its data
expires.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(sandbox): don't leave for /register when sign-out failed

CodeRabbit review: the ExtensionSandboxLockState CTA ignored the
signOut() result, so a failure routed to /register with the anonymous
session still live, which registers INTO the sandbox instead of leaving
it: exactly what the sign-out exists to prevent. Surface the failure and
stay put so the user can retry.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

components/dashboard/SkatteverketPromoCard.tsx

@@ -6,7 +6,7 @@ import { ArrowRight, FileCheck, X } from 'lucide-react'
 import { Card, CardContent } from '@/components/ui/card'
 import { Button } from '@/components/ui/button'
 import { ENABLED_EXTENSION_IDS } from '@/lib/extensions/_generated/enabled-extensions'
-import { useCapability } from '@/contexts/CompanyContext'
+import { useCapability, useCompanyOptional } from '@/contexts/CompanyContext'
 import { CAPABILITY } from '@/lib/entitlements/keys'
 
 const dismissKey = (companyId: string) => `erp_skv_promo_dismissed:${companyId}`
@@ -36,11 +36,14 @@ interface SkatteverketPromoCardProps {
  * otherwise only discover the integration deep inside the VAT/AGI flows.
  * Capability-less users never see it: the paywall upsell lives where the
  * intent is (SkatteverketPanel, AGIPanel), not on the dashboard.
+ * Sandbox companies never see it either: Skatteverket is one of the external
+ * services the sandbox blocks outright, so the CTA would lead nowhere.
  */
 export function SkatteverketPromoCard({ companyId, connected }: SkatteverketPromoCardProps) {
   const t = useTranslations('dashboard')
   const extensionEnabled = ENABLED_EXTENSION_IDS.has('skatteverket')
   const hasCapability = useCapability(CAPABILITY.skatteverket)
+  const isSandbox = useCompanyOptional()?.isSandbox ?? false
 
   // Server snapshot says dismissed: the card appears only after hydration,
   // when localStorage is readable, so server and client never disagree.
@@ -55,7 +58,7 @@ export function SkatteverketPromoCard({ companyId, connected }: SkatteverketProm
     window.dispatchEvent(new Event(DISMISS_EVENT))
   }, [companyId])
 
-  if (!extensionEnabled || !hasCapability || connected || dismissed) return null
+  if (!extensionEnabled || !hasCapability || isSandbox || connected || dismissed) return null
 
   return (
     <section>