feat: production readiness — 3-extension deploy with security hardening and observability

- Strip extensions to enable-banking, ai-categorization, ai-chat only
- Remove push-notifications cron from vercel.json
- Add security headers (HSTS, CSP, X-Frame-Options, Permissions-Policy)
- Add /api/health endpoint for uptime monitoring
- Add env var validation in ensureInitialized()
- Fix SIE4 #IB opening balance records from year-end closing entry
- Replace in-memory ai-chat rate limiter with Supabase-backed distributed rate limiting
- Add Sentry error tracking scaffolding (@sentry/nextjs, instrumentation hook)
- Add AI token usage tracking (migration 047, usage-tracker, wired into both AI extensions)
- Include pending enable-banking and dashboard improvements

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

lib/ai/usage-tracker.ts

@@ -0,0 +1,35 @@
+import type { SupabaseClient } from '@supabase/supabase-js'
+import { createLogger } from '@/lib/logger'
+
+const log = createLogger('ai-usage')
+
+interface TokenUsage {
+  inputTokens: number
+  outputTokens: number
+  model: string
+}
+
+/**
+ * Track AI token usage. Non-blocking — errors are logged, not thrown.
+ */
+export function trackTokenUsage(
+  supabase: SupabaseClient,
+  userId: string,
+  extensionId: string,
+  usage: TokenUsage
+): void {
+  supabase
+    .from('ai_usage_tracking')
+    .insert({
+      user_id: userId,
+      extension_id: extensionId,
+      model: usage.model,
+      input_tokens: usage.inputTokens,
+      output_tokens: usage.outputTokens,
+    })
+    .then(({ error }) => {
+      if (error) {
+        log.error(`Failed to track usage for ${extensionId}:`, error.message)
+      }
+    })
+}