feat(sat): reporte diario de errores SAT por proxy

- Agrega tabla sat_proxy_errors con proxy_usado, error_code, stage, message.
- sat-client.service.ts expone proxyInfo usado en cada conexión SAT.
- sat.service.ts registra errores de bloqueo/devolución del SAT en sat_proxy_errors
  y guarda proxyUsed en sat_sync_jobs.
- Nuevo job sat-proxy-report.job.ts: cron 8 AM CDMX, envía email a ADMIN_EMAIL
  con errores de las últimas 24h agrupados por proxy/error_code.
- Template de email sat-proxy-report.ts y método sendSatProxyReport.
- Registra el cron en src/index.ts.
- Actualiza docs/SAT-SYNC-IMPLEMENTATION.md.

apps/api/scripts/test_old_jwt.ts

@@ -0,0 +1,47 @@
+import { PrismaClient } from '@prisma/client';
+import { generateAccessToken } from '../src/auth/tokens';
+import axios from 'axios';
+
+async function main() {
+  const prisma = new PrismaClient();
+  
+  const user = await prisma.user.findUnique({
+    where: { email: 'ivan@horuxfin.com' },
+  });
+  
+  if (!user) { console.log('User not found'); return; }
+  
+  // Simulate OLD JWT (NO platformRoles) — exactly what Ivan has if he never re-logged
+  const oldToken = generateAccessToken({
+    userId: user.id,
+    email: user.email,
+    role: 'contador',
+    tenantId: 'c52c2f5d-b1ae-45c6-8cc8-b11c9611618a',
+    tokenVersion: user.tokenVersion,
+    // NO platformRoles field
+  });
+  
+  const baseURL = process.env.NEXT_PUBLIC_API_URL || 'http://localhost:4000/api';
+  
+  async function test(name: string, url: string, headers?: any) {
+    try {
+      const r = await axios.get(`${baseURL}${url}`, {
+        headers: { Authorization: `Bearer ${oldToken}`, ...headers },
+        timeout: 10000,
+      });
+      console.log(`✅ ${name}: ${r.status}`);
+    } catch (e: any) {
+      console.log(`❌ ${name}: ${e.response?.status} ${JSON.stringify(e.response?.data)}`);
+    }
+  }
+  
+  console.log('=== Testing with OLD JWT (no platformRoles) ===');
+  await test('/tenants', '/tenants');
+  await test('/tenants/mine', '/tenants/mine');
+  await test('/admin/dashboard/despachos', '/admin/dashboard/despachos');
+  await test('/contribuyentes', '/contribuyentes');
+  
+  await prisma.$disconnect();
+}
+
+main().catch(e => { console.error(e); process.exit(1); });