fix(sandbox): lock what the sandbox cannot actually do (#1318)

* fix(sandbox): lock what the sandbox cannot actually do

Three surfaces in the sandbox advertised capability the sandbox blocks
outright, or rendered a staged preview wrong.

Skatteverket promo card: hidden for sandbox companies. The sandbox landing
page tells users Skatteverket is off, and the authorize route 403s via
guardSandbox, so the dashboard nudge was a dead end. Same precedent as
TaxSettingsContent, which already hides its Skatteverket section on
is_sandbox.

Dokumentinkorg: locked with a state that says what the workspace does and
sends the user to registration. Checked before the capability gate on
purpose: the seed_trial trigger grants every new company (sandbox
included) 30 days of every paid capability, so the existing paywall waved
a demo company straight through. The CTA signs the anonymous session out
first, mirroring SandboxBanner.

Staged categorize_transaction preview: the seed wrote its kontering under
the generic preview_lines key, but categorize_transaction is the one type
with a dedicated preview component, and it reads `lines`. The card fell
through to its legacy summary branch and rendered blank Debetkonto and
Kreditkonto plus "NaN kr" from formatCurrency(undefined). The seeded blob
now mirrors what gnubok_categorize_transaction stages, extracted into
buildSandboxPendingOperations so both shapes are unit-testable.
CategorizePreview also learns to read preview_lines and to show a missing
amount as a gap, so a live 24h sandbox stops showing NaN before its data
expires.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* fix(sandbox): don't leave for /register when sign-out failed

CodeRabbit review: the ExtensionSandboxLockState CTA ignored the
signOut() result, so a failure routed to /register with the anonymous
session still live, which registers INTO the sandbox instead of leaving
it: exactly what the sign-out exists to prevent. Surface the failure and
stay put so the user can retry.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

messages/en.json

@@ -4511,6 +4511,11 @@
     "upsell_title": "Upgrade to use {name}",
     "upsell_description": "This feature is included in a paid subscription. Upgrade to enable it.",
     "upsell_cta": "Upgrade",
+    "sandbox_locked_title": "{name} is locked in the sandbox",
+    "sandbox_locked_note": "The sandbox runs entirely without external services, so this feature is switched off here. Create an account to use it for real.",
+    "sandbox_locked_cta": "Create account",
+    "sandbox_locked_signout_error_title": "Could not leave the sandbox",
+    "sandbox_locked_signout_error_description": "Please try again in a moment.",
     "breadcrumb": "Extensions",
     "extension_count": "{count} extensions",
     "data_pattern_core": "Uses bookkeeping data",

messages/sv.json

@@ -4511,6 +4511,11 @@
     "upsell_title": "Uppgradera för att använda {name}",
     "upsell_description": "Den här funktionen ingår i en betald prenumeration. Uppgradera för att aktivera den.",
     "upsell_cta": "Uppgradera",
+    "sandbox_locked_title": "{name} är låst i sandlådan",
+    "sandbox_locked_note": "Sandlådan kör helt utan externa tjänster, så den här funktionen är avstängd här. Skapa ett konto för att använda den på riktigt.",
+    "sandbox_locked_cta": "Skapa konto",
+    "sandbox_locked_signout_error_title": "Kunde inte lämna sandlådan",
+    "sandbox_locked_signout_error_description": "Försök igen om en stund.",
     "breadcrumb": "Tillägg",
     "extension_count": "{count} tillägg",
     "data_pattern_core": "Använder bokföringsdata",