feat(inbox): staged upload ack, HEIC/HEIF validation, WhatsApp silence fixes (#1605)

* fix(whatsapp): app-side unmute, close silent intake paths, health visibility

- add POST /link/unmute and a Reactivate control on the Pausad state
- company resolution: transient query errors release the row for sweep
  retry; genuine zero-options sends M19 instead of parking silently
- media from unlinked senders bypasses the hourly greeting throttle
  (10 min burst window, daily cap kept)
- GET /link returns 7-day failed-delivery and parked-inbound counts;
  sweep summary logs outboundFailed24h

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(documents): real HEIC/HEIF magic-byte validation, bilingual upload errors

- detect ISO-BMFF ftyp brands (heic/heix/heim/heis/hevc/hevx/hevm/hevs,
  mif1/msf1) instead of exempting image/heic from validation; declared
  heic/heif accepts either family member (iOS labels vary)
- new INBOX_UPLOAD_* structured error codes replace raw English strings
  on the inbox upload and attach-document routes
- registry doc corrected to the real 10 MB cap

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* feat(inbox): staged upload with instant ack and deferred AI extraction

- web uploads insert the inbox item as status processing and respond
  immediately; Bedrock extraction and supplier match run via after()
  with a CAS flip to received (email and WhatsApp channels keep the
  synchronous path)
- widen invoice_inbox_items.status CHECK to include processing
  (migration 20260813180000, pg-real test included)
- crash-recovery sweep cron (*/2) flips stale processing rows;
  bulk-book skips extraction_in_progress items
- workspace: processing chip, in-flight rows disable actions, realtime
  flip, retry-extraction button for empty extractions
- picker accept list drops HEIC/HEIF so iOS transcodes library photos
  to JPEG; server allowlists unchanged (supersedes 2026-08-01 HEIC
  decision, see DECISIONS.md)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(migrations): bump inbox processing-status migration past main's latest

Main merged 20260813210000 while this PR was in flight; an inserted
version older than the latest applied aborts the prod db push at merge.
Renamed 20260813180000 to 20260813213000 and updated references.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(decisions): log preview-tracker orphan repair after migration rename

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/errors/structured-errors.ts

@@ -2017,6 +2017,40 @@ const DOCUMENT: Record<string, StructuredErrorEntry> = {
   },
 }
 
+// Invoice-inbox manual upload and attach-document (extension REST routes).
+const INBOX_UPLOAD: Record<string, StructuredErrorEntry> = {
+  INBOX_UPLOAD_NO_FILE: {
+    httpStatus: 400,
+    message_sv: 'Ingen fil bifogad.',
+    message_en: 'No file attached.',
+  },
+  INBOX_UPLOAD_TOO_LARGE: {
+    httpStatus: 400,
+    message_sv: 'Filen är för stor. Maxstorlek är 10 MB.',
+    message_en: 'File exceeds the 10 MB size limit.',
+  },
+  INBOX_UPLOAD_UNSUPPORTED_TYPE: {
+    httpStatus: 400,
+    message_sv: 'Filtypen stöds inte. Tillåtna format: PDF, JPEG, PNG, HEIC och WebP.',
+    message_en: 'Unsupported file type. Allowed: PDF, JPEG, PNG, HEIC, WebP.',
+  },
+  INBOX_UPLOAD_TX_NOT_IN_COMPANY: {
+    httpStatus: 400,
+    message_sv: 'Den angivna transaktionen (matched_transaction_id) tillhör ett annat företag.',
+    message_en: 'matched_transaction_id refers to a transaction outside this company.',
+  },
+  INBOX_UPLOAD_FAILED: {
+    httpStatus: 500,
+    message_sv: 'Uppladdningen misslyckades. Försök igen.',
+    message_en: 'Upload failed.',
+  },
+  INBOX_ATTACH_FAILED: {
+    httpStatus: 500,
+    message_sv: 'Bilagan kunde inte kopplas. Försök igen.',
+    message_en: 'Failed to attach the document.',
+  },
+}
+
 const CUSTOMER: Record<string, StructuredErrorEntry> = {
   CUSTOMER_NOT_FOUND: {
     httpStatus: 404,
@@ -3530,6 +3564,7 @@ const REGISTRY: Record<string, StructuredErrorEntry> = {
   ...REGISTER_IMPORT,
   ...PROVIDER_MIGRATION,
   ...DOCUMENT,
+  ...INBOX_UPLOAD,
   ...CUSTOMER,
   ...ARTICLE,
   ...SUPPLIER,