Mcp/template data feedback (#617)

* fix(booking-templates): scope template list to the active company

GET /api/settings/booking-templates relied solely on the btl_select RLS
policy, which is membership-wide (user_company_ids) and returns templates
from every company the user belongs to. A user who owns multiple companies
saw all their templates merged regardless of which company was active.

Narrow the list in the API layer (mirroring counterparty-templates) to
system + the active company + the active company's team. RLS stays the
security backstop; this fixes the cross-company merge within a single
user's own view (it was never a cross-tenant data leak).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(import): show proper message for duplicate bank file upload

The bank file import page mis-parsed the structured error envelope
({ error: { code, message, details } }), so a BANK_FILE_DUPLICATE
(409) fell through to the generic "Kunde inte läsa filen" fallback.
The upload step also hardcoded that same string as the error heading,
so duplicates were doubly misreported as parse failures.

- Parse the structured envelope by error.code; surface error.message
  for all codes instead of rendering the error object.
- Add a dedicated BANK_FILE_DUPLICATE message using the importedAt /
  importedCount details the route already returns.
- Add an optional errorTitle prop to BankFileUploadStep (defaults to
  the previous text) and pass "Filen är redan importerad" for dupes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(tests): add comprehensive tests for recordateEntry, inbox-linking, and external-id handling

- Implemented unit tests for recordateEntry in the bookkeeping module to validate various scenarios including date changes, non-posted entries, and fiscal period restrictions.
- Created tests for inbox-linking status in pending operations to ensure correct handling of invoice inbox items and supplier invoices, addressing historical bugs related to status updates.
- Added tests for external-id utilities to ensure consistent handling of monetary amounts and deduplication keys across different transaction sources.
- Introduced new functions in external-id.ts for stable external ID generation and normalization of imported descriptions, enhancing transaction deduplication reliability.

feat(migrations): add new database migrations for transaction handling

- Created migration to exclude storno and correction vouchers from unmatched GL lines, ensuring accurate reconciliation.
- Added a migration to preserve original bank transaction descriptions in a new immutable column, allowing for user edits while maintaining audit trails and deduplication integrity.

* feat(migrations): add function to exclude storno/correction vouchers from unmatched GL lines

* feat(transactions): enhance transaction handling with improved description normalization and preloaded original entries

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/helpers.ts

@@ -175,6 +175,8 @@ export function makeTransaction(overrides: Partial<Transaction> = {}): Transacti
     external_id: null,
     date: '2024-06-15',
     description: 'ICA MAXI STOCKHOLM',
+    original_description: 'ICA MAXI STOCKHOLM',
+    title_edited_at: null,
     amount: -299.0,
     currency: 'SEK',
     amount_sek: null,

tests/pg/get_unlinked_1930_lines.pg.test.ts

@@ -17,7 +17,7 @@ async function insertPostedJournalEntry(params: {
   companyId: string
   fiscalPeriodId: string
   entryDate: string
-  sourceType: 'opening_balance' | 'manual' | 'bank_transaction' | 'import'
+  sourceType: 'opening_balance' | 'manual' | 'bank_transaction' | 'import' | 'storno' | 'correction'
   voucherNumber: number
   amount?: number
 }): Promise<string> {
@@ -104,6 +104,44 @@ describe('get_unlinked_gl_lines RPC — opening_balance exclusion', () => {
     expect(rows.find((r) => r.source_type === 'opening_balance')).toBeUndefined()
   })
 
+  it('excludes storno and correction vouchers from the unmatched-1930 set', async () => {
+    const userId = await insertAuthUser()
+    const companyId = await insertCompany({ createdBy: userId })
+    const fiscalPeriodId = await insertFiscalPeriod({
+      userId,
+      companyId,
+      periodStart: '2026-01-01',
+      periodEnd: '2026-12-31',
+    })
+
+    // A storno and a correction voucher on 1930 (the products of the correctEntry
+    // flow), plus a normal bank voucher. Stornos/corrections are book-only
+    // reversals with no bank-feed counterpart — they must be EXCLUDED so a
+    // reconciled period doesn't show them as omatchade verifikationer.
+    await insertPostedJournalEntry({
+      userId, companyId, fiscalPeriodId,
+      entryDate: '2026-05-02', sourceType: 'storno', voucherNumber: 20, amount: 25000,
+    })
+    await insertPostedJournalEntry({
+      userId, companyId, fiscalPeriodId,
+      entryDate: '2026-05-02', sourceType: 'correction', voucherNumber: 21, amount: 25000,
+    })
+    const bankEntryId = await insertPostedJournalEntry({
+      userId, companyId, fiscalPeriodId,
+      entryDate: '2026-05-03', sourceType: 'bank_transaction', voucherNumber: 22, amount: 1500,
+    })
+
+    const { rows } = await getPool().query(
+      `SELECT journal_entry_id, source_type FROM public.get_unlinked_gl_lines($1)`,
+      [companyId],
+    )
+
+    const returnedIds = new Set(rows.map((r) => r.journal_entry_id))
+    expect(returnedIds.has(bankEntryId)).toBe(true)
+    expect(rows.find((r) => r.source_type === 'storno')).toBeUndefined()
+    expect(rows.find((r) => r.source_type === 'correction')).toBeUndefined()
+  })
+
   it('still applies date_from / date_to filtering', async () => {
     const userId = await insertAuthUser()
     const companyId = await insertCompany({ createdBy: userId })