feat(import/export): article import + register export (xlsx/csv) (#750)

* feat(import/export): article import + register export (xlsx/csv)

Add CSV/Excel import for the article register (artiklar), mirroring the
existing customer/supplier import pipeline, plus Excel + CSV export for
articles, customers and suppliers.

Import (lib/import/articles + app/api/import/articles):
- Column auto-detection tuned to Fortnox/Visma/Bokio export headers,
  Swedish-decimal price parsing, VAT snapped to {0,6,12,25}, type/unit
  normalization.
- Dedup by article number then name; 23505 soft-skip; auto-number
  backfill; revenue-account override kept only when active, otherwise
  dropped with a warning (never mutates the chart of accounts).
- New "Artiklar" flow in the /import hub.

Export (app/api/export/* + lib/export/register-export):
- Read-only xlsx (default) / csv (?format=csv, UTF-8 BOM) downloads.
- Headers chosen so files round-trip back through the importer.
- "Exportera" menu added to the articles, customers and suppliers pages.

Refs #746. Direct Fortnox/Visma API article fetch tracked in #749.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(import/export): address PR review — lint ratchet + export hardening

- xlsx-export: keep `SheetSpec<any>` on the eslint-disabled line (fixes the
  core-only lint ratchet regression: no-explicit-any 16 -> 15) and define
  UTF8_BOM as an explicit `` escape instead of a raw BOM character.
- export routes (articles/customers/suppliers): move the data queries inside
  the try/catch, add `Cache-Control: no-store`, and emit a `register exported`
  audit log line (entity, format, rowCount).
- articles parse route: validate `column_overrides` against a Zod schema before
  trusting it to drive the parser.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(import): drop öre-round pattern on article column-detector confidence

The confidence score is a 0-1 heuristic, not money, and is only compared
against the 0.8 skip-mapping threshold. Removing the Math.round(x*100)/100
form clears the core-only antipattern ratchet (naive-ore-round 660 -> 659).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(import): flag adjusted VAT rows in the article import edit step

Surface VAT snapping/defaulting per row, not just as a file-level warning:
the parser sets `vat_rate_adjusted`, the edit step highlights those rows'
VAT selector and shows a count banner, and confirming a rate clears the flag.
Addresses the Swedish-compliance review note that silent snapping could
otherwise store a wrong VAT rate at scale.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/api/schemas.ts

@@ -1430,6 +1430,49 @@ export const SupplierImportExecuteSchema = z.object({
   update_duplicates: z.boolean(),
 })
 
+const ImportedArticleRowSchema = z.object({
+  row_index: z.number().int(),
+  name: z.string().min(1),
+  name_en: z.string().nullable(),
+  article_number: z.string().nullable(),
+  type: ArticleTypeSchema,
+  unit: z.string(),
+  price_excl_vat: nonNegativeAmount,
+  vat_rate: vatRatePercent,
+  // The execute route re-validates against the chart of accounts (and drops
+  // unknown/inactive overrides), so a loose nullable string is enough here.
+  revenue_account: z.string().nullable(),
+  cost_price: nonNegativeAmount.nullable(),
+  ean: z.string().nullable(),
+  housework_type: z.string().nullable(),
+  notes: z.string().nullable(),
+})
+
+export const ArticleImportExecuteSchema = z.object({
+  rows: z.array(ImportedArticleRowSchema).min(1, 'At least one row is required'),
+  update_duplicates: z.boolean(),
+})
+
+// Validates the optional column-mapping override posted to the parse route, so
+// a malformed/hostile blob can't drive the parser with non-numeric or
+// unexpected column indices. Mirrors DetectedArticleColumns.
+const articleColumnIndex = z.number().int().min(0).nullable()
+export const ArticleColumnOverridesSchema = z.object({
+  name_col: z.number().int().min(0),
+  article_number_col: articleColumnIndex,
+  name_en_col: articleColumnIndex,
+  type_col: articleColumnIndex,
+  unit_col: articleColumnIndex,
+  price_col: articleColumnIndex,
+  vat_rate_col: articleColumnIndex,
+  revenue_account_col: articleColumnIndex,
+  cost_price_col: articleColumnIndex,
+  ean_col: articleColumnIndex,
+  housework_type_col: articleColumnIndex,
+  notes_col: articleColumnIndex,
+  confidence: z.number(),
+})
+
 // ============================================================
 // Salary schemas
 // ============================================================