// PATCH: Lägg till detta efter authMiddleware-raden i index.mjs

// ── RBAC: Rollskydd på muterande endpoints ───────────────────────────────────
// GET /api/ledger/accounts — läs-only (alla roller)
// POST /api/ledger/accounts — kräver admin eller accountant
app.post('/api/ledger/accounts', requireRole(ROLES.ADMIN, ROLES.ACCOUNTANT), async (req, res) => {
  // befintlig kod...
});

// POST /api/ledger/journal — skapa verifikation
app.post('/api/ledger/journal', requireRole(ROLES.ADMIN, ROLES.ACCOUNTANT), async (req, res) => {
  // befintlig kod...
});

// POST /api/ledger/journal/:id/post — kontera
app.post('/api/ledger/journal/:id/post', requireRole(ROLES.ADMIN, ROLES.ACCOUNTANT), async (req, res) => {
  // befintlig kod...
});

// POST /api/ledger/journal/:id/void — makulera
app.post('/api/ledger/journal/:id/void', requireRole(ROLES.ADMIN), async (req, res) => {
  // befintlig kod...
});

// POST /api/ledger/period-close/initiate — stäng period
app.post('/api/ledger/period-close/initiate', requireRole(ROLES.ADMIN), async (req, res) => {
  // befintlig kod...
});

// POST /api/ledger/reconciliation/sessions — skapa reconciliation
app.post('/api/ledger/reconciliation/sessions', requireRole(ROLES.ADMIN, ROLES.ACCOUNTANT), async (req, res) => {
  // befintlig kod...
});

// POST /api/ledger/reconciliation/sessions/:id/complete — slutför reconciliation
app.post('/api/ledger/reconciliation/sessions/:id/complete', requireRole(ROLES.ADMIN), async (req, res) => {
  // befintlig kod...
});