Fix/dependabot cus feedback (#946)

* feat(bookkeeping): per-account default VAT, oresavrundning momsfri

Add a per-account "Standard moms" setting to the chart of accounts and use
it to auto-fill the moms on a leverantorsfaktura-rad when that konto is
picked. Oresavrundning (3740) ships as "Ingen moms", so a rounding line no
longer inherits the 25 % rad-default and skews the moms.

- chart_of_accounts.default_vat_rate (0/0.06/0.12/0.25, CHECK-constrained)
- BEFORE INSERT trigger ships 3740 momsfri on every insert path; backfills
  existing 3740 rows
- kontoplan editor: dead free-text momskod replaced with a Standard moms select
- supplier-invoice rad auto-fills the rate from the konto default

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(supplier-invoices): configurable start number for the ankomstnummer series

Add a company_settings.next_arrival_number start floor so a company can continue its leverantorsfaktura numbering from a previous system (e.g. Fortnox) instead of restarting the ankomstnummer at 1. get_next_arrival_number now floors the series via GREATEST(MAX(arrival_number)+1, next_arrival_number), so the floor can never move the series backwards or collide with the (company_id, arrival_number) unique index.

The RPC is hardened while rewritten: SET search_path to empty, schema-qualified refs, and an auth.uid() membership check matching generate_invoice_number.

Includes the settings UI field, sv/en strings, migration, and pg-real coverage. The CompanySettings type and Zod schema field for this feature landed earlier in 1bf3b641 (swept into the per-account VAT commit).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(dependabot): reduce open pull requests limit and group updates for better management

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/dependabot.yml

@@ -1,4 +1,13 @@
 version: 2
+# Deliberately throttled to avoid a PR flood. Two knobs do the work:
+#   - open-pull-requests-limit: 1  -> at most ONE open PR per ecosystem at a
+#     time. Dependabot will not open next week's PR until the current one is
+#     merged or closed, so PRs can never pile up.
+#   - groups (patterns: "*")       -> every available bump (major/minor/patch)
+#     is batched into that single PR instead of one PR per package.
+# Combined with the weekly schedule this means: normally one npm PR a week (or
+# none), and only in a rare week where Docker/Actions also move do you see more
+# than one PR at all.
 updates:
   # Base images in the root Dockerfile (node:22-alpine).
   - package-ecosystem: docker
@@ -6,7 +15,11 @@ updates:
     schedule:
       interval: weekly
       day: monday
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 1
+    groups:
+      docker:
+        patterns:
+          - "*"
     labels:
       - dependencies
       - docker
@@ -17,7 +30,11 @@ updates:
     schedule:
       interval: weekly
       day: monday
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 1
+    groups:
+      docker-cron:
+        patterns:
+          - "*"
     labels:
       - dependencies
       - docker
@@ -28,7 +45,11 @@ updates:
     schedule:
       interval: weekly
       day: monday
-    open-pull-requests-limit: 5
+    open-pull-requests-limit: 1
+    groups:
+      github-actions:
+        patterns:
+          - "*"
     labels:
       - dependencies
       - ci
@@ -39,16 +60,15 @@ updates:
     schedule:
       interval: weekly
       day: monday
-    open-pull-requests-limit: 10
+    open-pull-requests-limit: 1
     labels:
       - dependencies
       - npm
     groups:
-      # Batch low-risk minor/patch bumps so the reviewer queue stays small.
-      minor-and-patch:
-        update-types:
-          - minor
-          - patch
+      # Batch ALL bumps (major/minor/patch) into a single weekly PR.
+      npm:
+        patterns:
+          - "*"
     ignore:
       # @anthropic-ai/bedrock-sdk is PINNED to an exact version in package.json.
       # 0.32.0 arrived inside a grouped minor-and-patch bump (#884) and broke