Accounted rebrand + swarm-skill cleanup + bank-reconciliation fixes (#643)

* feat(reconciliation): close the bank-feed loop on voucher links and re-tag mis-typed opening balances

Two related fixes to bank reconciliation correctness:

1. Auto-reconcile on voucher link. Linking an invoice or supplier invoice to
   an existing voucher previously advanced only the invoice — the bank
   transaction that paid it kept sitting in the Transactions inbox with a null
   journal_entry_id. linkInvoiceToVoucher / linkSupplierInvoiceToVoucher now
   call autoReconcileTransactionForLinkedVoucher (lib/reconciliation), which
   links the bank transaction to the same verifikat when exactly one unbooked
   line matches it. Best-effort and post-commit: a failure here never fails the
   link. The result surfaces reconciledTransactionId; the inbox row leaves the
   list and the UI shows link_success_tx_reconciled.

2. Re-tag mis-typed opening balances. getReconciliationStatus and the GL-line
   matching RPCs identify a cash account's ingående balans solely by
   journal_entries.source_type='opening_balance'. Companies migrated from other
   systems often booked the bank IB as an ordinary voucher (source_type
   'import' or 'manual'), so it was never excluded and surfaced as a phantom
   reconciliation difference equal to the opening balance. Adds:
   - migration mark_entry_as_opening_balance: a GUC-gated carve-out in the
     immutability trigger plus a SECURITY DEFINER RPC that validates the entry
     (balance-sheet lines only, dated on a fiscal-period boundary), flips the
     source_type, and writes an audit row — no blanket data sweep.
   - POST /api/reconciliation/bank/mark-opening-balance + MarkOpeningBalanceSchema.
   - BankReconciliationView action to trigger it from the IB diff.

The gnubok_create_voucher executor now accepts a typed is_opening_balance flag
and derives source_type='opening_balance' only after validating class 1/2 lines
on the period start, so new IBs land correctly typed.

Covered by lib/reconciliation auto-reconcile tests, voucher-executors tests,
and a mark-entry-as-opening-balance pg-real test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore: rebrand gnubok → Accounted and prune swarm agent skills

Product rebrand and skills housekeeping. No runtime behaviour change.

Rebrand: replace user-visible "gnubok" with "Accounted" across docs, READMEs,
in-code comments, doc-site content, MCP skill/resource prose, and the
gnubok-mcp package description. The MCP resource URI scheme is moved gnubok://
→ Accounted:// consistently across resource registrations, the event-type
comment, and the resource/skill tests. Deliberately preserved as stable
identifiers (NOT rebranded): the gnubok-company-id cookie, gnubok_sk_ / gnubok_inv_
token prefixes, the gnubok-mcp npm bridge name, and the AGI <gem:Programnamn>
value (kept 'gnubok' per its source comment — it is the software identifier sent
to Skatteverket and must not churn across visual rebrands).

Skills: remove the 27 swarm-* agent SKILL.md atoms (no longer used; already
absent from the agent_atom_registry in prod), refresh the remaining skill docs,
add the .claude/rules/ path-scoped rule set, and regenerate the
seed_agent_atom_bodies migration + .skill-body-manifest.json via
`npm run skills:generate` so the DB-backed skill bodies match the trimmed set.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/api/schemas.ts

@@ -975,6 +975,16 @@ export const BankUnlinkSchema = z.object({
   transaction_id: uuid,
 })
 
+/**
+ * Re-tag a mis-typed bank-account opening balance (a manual/import voucher that
+ * is really an ingående balans) as source_type='opening_balance' so bank
+ * reconciliation excludes it from the period movement. Routed to the
+ * mark_entry_as_opening_balance SECURITY DEFINER RPC, which enforces the rest.
+ */
+export const MarkOpeningBalanceSchema = z.object({
+  journal_entry_id: uuid,
+})
+
 export const RunReconciliationSchema = z.object({
   date_from: isoDate.optional(),
   date_to: isoDate.optional(),

lib/api/v1/load-routes.ts

@@ -27,7 +27,7 @@ import '@/app/api/v1/companies/[companyId]/journal-entries/[id]/correct/route'
 import '@/app/api/v1/companies/[companyId]/journal-entries/batch-create/route'
 import '@/app/api/v1/companies/[companyId]/voucher-gap-explanations/route'
 
-// Phase 4 PR-2 — compliance-check (gnubok's defensible edge).
+// Phase 4 PR-2 — compliance-check (Accounted's defensible edge).
 import '@/app/api/v1/companies/[companyId]/compliance/check/route'
 
 // Phase 4 PR-2 — fiscal-periods async ops (lock/close/year-end/opening-balances/currency-revaluation).

lib/api/v1/registry.ts

@@ -297,10 +297,10 @@ export function generateOpenApiSpec(serverUrl: string): OpenApiSpec {
   return {
     openapi: '3.1.0',
     info: {
-      title: 'gnubok API',
+      title: 'Accounted API',
       version: API_V1_VERSION,
       description:
-        'Public REST API for gnubok — Swedish double-entry bookkeeping. ' +
+        'Public REST API for Accounted — Swedish double-entry bookkeeping. ' +
         'Every write supports dry-run via `?dry_run=true`. Every request must include ' +
         '`Authorization: Bearer gnubok_sk_...`. See /docs/api for the cookbook.',
     },

lib/api/v1/security-headers.ts

@@ -30,7 +30,7 @@ export const PUBLIC_SECURITY_HEADERS: Record<string, string> = {
   // form contexts. `default-src 'none'` is the strictest possible CSP and
   // costs nothing here.
   'Content-Security-Policy': "default-src 'none'; frame-ancestors 'none'",
-  // HSTS — every gnubok deployment is HTTPS-only. 1 year is the standard
+  // HSTS — every Accounted deployment is HTTPS-only. 1 year is the standard
   // production value; includeSubDomains because the apex serves everything.
   'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
 }