feat: complete multi-tenant refactor + settings validation + fiscal period API (#156)

* feat: complete multi-tenant refactor for reconciliation, arcim, settings validation

- Migrate bank-reconciliation to company_id (all functions + tests)
- Migrate arcim-migration entity mappers and orchestrator to company_id
- Fix enable-banking reconciliation calls to use companyId
- Add Swedish law validation to settings schema:
  - VAT number required when VAT-registered (ML 11 kap. 8§)
  - Moms period required when VAT-registered (SFL 26 kap.)
  - Aktiebolag must use accrual accounting (BFNAR 2006:1)
- Fix fiscal year period creation: always 12 months after first year (BFL 3 kap.)
- Add plusgiro, website, pays_salaries fields to CompanySettings
- Add plusgiro to invoice PDF template
- Add fiscal period CRUD and opening balances API routes
- Add frame-src CSP directive for future iframe embedding
- Fix unlinked_1930_lines RPC to use company_id parameter
- Update CLAUDE.md documentation

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* fix: address PR review findings (P1 + P2)

- Fix reconciliation events emitting companyId as userId — thread
  actual userId through runReconciliation and manualLink
- Move VAT cross-field validation (vat_number, moms_period) from
  schema refinements to route handler where effective stored state
  is available, preventing false rejection on partial updates
- Add plusgiro format validation regex (N-N pattern)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

app/api/settings/route.ts

@@ -43,7 +43,7 @@ export async function PUT(request: Request) {
   // Fetch current settings to check for tax-relevant changes
   const { data: oldSettings } = await supabase
     .from('company_settings')
-    .select('entity_type, moms_period, f_skatt, vat_registered, pays_salaries, fiscal_year_start_month, onboarding_complete')
+    .select('entity_type, moms_period, f_skatt, vat_registered, vat_number, pays_salaries, fiscal_year_start_month, onboarding_complete')
     .eq('company_id', companyId)
     .single()
 
@@ -67,6 +67,33 @@ export async function PUT(request: Request) {
     )
   }
 
+  // Validate: aktiebolag must use accrual accounting (BFNAR 2006:1)
+  if (effectiveEntityType === 'aktiebolag' && body.accounting_method === 'cash') {
+    return NextResponse.json(
+      { error: 'Aktiebolag måste använda faktureringsmetoden (BFNAR 2006:1)' },
+      { status: 400 }
+    )
+  }
+
+  // Validate: VAT-registered must have VAT number (ML 11 kap. 8§) and moms period (SFL 26 kap.)
+  const effectiveVatRegistered = body.vat_registered ?? oldSettings?.vat_registered
+  if (effectiveVatRegistered === true) {
+    const effectiveVatNumber = body.vat_number ?? oldSettings?.vat_number
+    if (!effectiveVatNumber) {
+      return NextResponse.json(
+        { error: 'Momsregistreringsnummer krävs när företaget är momsregistrerat (ML 11 kap. 8§)' },
+        { status: 400 }
+      )
+    }
+    const effectiveMomsPeriod = body.moms_period ?? oldSettings?.moms_period
+    if (!effectiveMomsPeriod) {
+      return NextResponse.json(
+        { error: 'Momsperiod krävs när företaget är momsregistrerat (SFL 26 kap.)' },
+        { status: 400 }
+      )
+    }
+  }
+
   const { data, error } = await supabase
     .from('company_settings')
     .update(body)