feat(sat): reporte diario de errores SAT por proxy

- Agrega tabla sat_proxy_errors con proxy_usado, error_code, stage, message.
- sat-client.service.ts expone proxyInfo usado en cada conexión SAT.
- sat.service.ts registra errores de bloqueo/devolución del SAT en sat_proxy_errors
  y guarda proxyUsed en sat_sync_jobs.
- Nuevo job sat-proxy-report.job.ts: cron 8 AM CDMX, envía email a ADMIN_EMAIL
  con errores de las últimas 24h agrupados por proxy/error_code.
- Template de email sat-proxy-report.ts y método sendSatProxyReport.
- Registra el cron en src/index.ts.
- Actualiza docs/SAT-SYNC-IMPLEMENTATION.md.

apps/api/scripts/test_ivan_full.ts

@@ -0,0 +1,69 @@
+import { PrismaClient } from '@prisma/client';
+import { generateAccessToken } from '../src/auth/tokens';
+import axios from 'axios';
+
+async function main() {
+  const prisma = new PrismaClient();
+  
+  const user = await prisma.user.findUnique({
+    where: { email: 'ivan@horuxfin.com' },
+  });
+  
+  if (!user) {
+    console.log('User not found');
+    return;
+  }
+  
+  // Simulate OLD JWT (without platformRoles) — as if Ivan logged in before getting platform_ti
+  const oldToken = generateAccessToken({
+    userId: user.id,
+    email: user.email,
+    role: 'contador',
+    tenantId: 'c52c2f5d-b1ae-45c6-8cc8-b11c9611618a',
+    tokenVersion: user.tokenVersion,
+  });
+  
+  // Simulate NEW JWT (with platformRoles)
+  const platformRoles = await prisma.userPlatformRole.findMany({
+    where: { userId: user.id },
+    select: { role: true },
+  });
+  const newToken = generateAccessToken({
+    userId: user.id,
+    email: user.email,
+    role: 'contador',
+    tenantId: 'c52c2f5d-b1ae-45c6-8cc8-b11c9611618a',
+    platformRoles: platformRoles.map(r => r.role as any),
+    tokenVersion: user.tokenVersion,
+  });
+  
+  const baseURL = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:4000/api';
+  
+  async function test(name: string, token: string, url: string, headers?: any) {
+    try {
+      const r = await axios.get(`${baseURL}${url}`, {
+        headers: { Authorization: `Bearer ${token}`, ...headers }
+      });
+      console.log(`${name}: ${r.status} OK`);
+    } catch (e: any) {
+      console.log(`${name}: ${e.response?.status} ${JSON.stringify(e.response?.data)}`);
+    }
+  }
+  
+  console.log('=== WITH OLD JWT (no platformRoles) ===');
+  await test('contribuyentes (no XVT)', oldToken, '/contribuyentes');
+  await test('contribuyentes-stats (no XVT)', oldToken, '/despachos/contribuyentes-stats?año=2026&mes=5');
+  await test('admin/dashboard/despachos', oldToken, '/admin/dashboard/despachos');
+  await test('contribuyentes (XVT=Husberto)', oldToken, '/contribuyentes', { 'X-View-Tenant': 'd75bf020-2008-4881-ab96-77467bf9e1fd' });
+  
+  console.log('');
+  console.log('=== WITH NEW JWT (with platformRoles) ===');
+  await test('contribuyentes (no XVT)', newToken, '/contribuyentes');
+  await test('contribuyentes-stats (no XVT)', newToken, '/despachos/contribuyentes-stats?año=2026&mes=5');
+  await test('admin/dashboard/despachos', newToken, '/admin/dashboard/despachos');
+  await test('contribuyentes (XVT=Husberto)', newToken, '/contribuyentes', { 'X-View-Tenant': 'd75bf020-2008-4881-ab96-77467bf9e1fd' });
+  
+  await prisma.$disconnect();
+}
+
+main().catch(e => { console.error(e); process.exit(1); });