fix(api): stabilize report pagination + declare real { data, meta } envelope on v1 single/write endpoints (#811)

* fix(reports): stabilize fetchAllRows paging to stop doubled/dropped balances (#790, #791)

PostgREST `.range()` paging is only correct when the underlying query has a
stable TOTAL order. Several aggregating report queries (general ledger, trial
balance, grundbok, supplier/AR ledgers, etc.) paginated without `.order()`, so
on datasets larger than one 1000-row page Postgres could return rows in a
different order between requests — silently DUPLICATING or SKIPPING rows on a
page boundary and doubling or dropping financial totals.

- fetch-all.ts: document the ordering invariant and add an optional
  `dedupeBy` defense-in-depth that drops cross-page duplicates and warns when
  it fires (surfaces a missing `.order()` in logs instead of corrupting money).
- Add a stable `.order()` (line PK or account_number) to every paginated query
  in lib/reports/ and the account-balances route; pass `dedupeBy` on the
  money-aggregating line queries.
- Add fetch-all unit tests and update report test fixtures to carry row ids.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(api): declare the real { data, meta } envelope on v1 single/write/204 endpoints (#794)

The OpenAPI generator derives each endpoint's documented body purely from its
registered `response.success` Zod schema, and that schema is never validated at
runtime — so a route could advertise a shape its handler never sends. #802
fixed this for list endpoints; the same drift was latent on single-resource and
write endpoints, which declared the bare resource schema instead of the
`{ data, meta }` envelope the handlers actually return.

- registry.ts: extend `ResponseMetaSchema` with the optional `audit` block and
  `partial_expansions` list that writes/expansions emit; add the `NoBodyResponse`
  sentinel so 204 DELETE handlers document a bare 204 instead of a phantom 200.
- Wrap every single/write endpoint's `response.success` in `dataEnvelope(...)`
  (or `NoBodyResponse` for 204s) across the v1 routes.
- Add a response-envelope contract test that fails CI if any JSON endpoint
  forgets to wrap its schema, with binary downloads and 204s as the only
  exemptions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(reports): extend paging dedupeBy to rc-basis-gaps and opening-balances

Address PR review: these two money-aggregating line queries already had the
stable `.order('id')` (so paging was correct) but didn't carry `id` in the
select, so they couldn't use the `dedupeBy` defense-in-depth that general-ledger
and trial-balance got. Select `id` and pass `dedupeBy: r => r.id` so the whole
report layer applies the ordering invariant consistently.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/reports/__tests__/general-ledger.test.ts

@@ -124,6 +124,54 @@ describe('generateGeneralLedger', () => {
     expect(acc1930.closing_balance).toBe(1250)
   })
 
+  it('does not double a balance when an unstable page boundary re-serves a line (#790/#791)', async () => {
+    // Reproduces the doubling bug's mechanism: a paginated query whose order
+    // was not stable can return the same journal_entry_line on two pages.
+    // Page 1 must be a FULL page (PAGE_SIZE rows) so fetchAllRows fetches a
+    // second page; page 2 re-serves the 5010 line. dedupeBy(line id) must
+    // collapse it so the single 4000 posting totals 4000, not 8000.
+    const PAGE_SIZE = 1000
+    const filler = Array.from({ length: PAGE_SIZE - 1 }, (_, i) => ({
+      id: `f${i}`,
+      account_number: '1930',
+      debit_amount: 0,
+      credit_amount: 0,
+      journal_entries: { entry_date: '2024-01-02', voucher_number: 1, voucher_series: 'A', description: 'filler', source_type: 'manual' },
+    }))
+    const rentLine = {
+      id: 'rent-line-1',
+      account_number: '5010',
+      debit_amount: 4000,
+      credit_amount: 0,
+      journal_entries: { entry_date: '2024-01-15', voucher_number: 2, voucher_series: 'A', description: 'Lokalhyra', source_type: 'manual' },
+    }
+
+    mockResults = {
+      fiscal_periods: [
+        { data: { period_start: '2024-01-01', period_end: '2024-12-31', opening_balance_entry_id: null }, error: null },
+      ],
+      journal_entry_lines: [
+        { data: [...filler, rentLine], error: null }, // page 1 — full → triggers page 2
+        { data: [rentLine], error: null },            // page 2 — duplicate of the 5010 line
+      ],
+      chart_of_accounts: [
+        {
+          data: [
+            { account_number: '1930', account_name: 'Företagskonto' },
+            { account_number: '5010', account_name: 'Lokalhyra' },
+          ],
+          error: null,
+        },
+      ],
+    }
+
+    const report = await generateGeneralLedger(supabase, 'company-1', 'period-1')
+
+    const acc5010 = report.accounts.find((a) => a.account_number === '5010')!
+    expect(acc5010.total_debit).toBe(4000) // not 8000
+    expect(acc5010.lines).toHaveLength(1) // verifikat listed once, not twice
+  })
+
   it('computes opening balance from prior period entries', async () => {
     mockResults = {
       fiscal_periods: [