feat(skills,cli): supplier avoirs + banque lire (bank-account discovery)

The two V9 follow-ups, both proven live on the sandbox.

- creditnote-create.sh: `kind:"supplier"` makes an avoir fournisseur on
  /supplierinvoices (type=2 + fk_facture_source, carries ref_supplier); default
  customer path unchanged. Proven: customer AVC002 (-240) + supplier AVF2026001
  (-144, ref_supplier carried, linked to source, validated).
- bank-accounts.sh + `arcodange sandbox accounts`: list bank accounts (id/label/
  bank) so a payment can pick its account_id. Needs `banque lire` (rights 111),
  now added to the provisioner's WRITE_IDS so fresh runs include it; the existing
  ai_agent_sandbox user was granted it live. GET /bankaccounts now returns the 3
  accounts (QONTO, WISE EURO, Compte Courant Asso).
- SKILL.md: supplier-avoir example + accounts helper + updated banque-lire note.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.claude/skills/dolibarr-sandbox-write/SKILL.md

@@ -102,20 +102,27 @@ echo '{"invoice_id":13,"kind":"supplier","mode":"VIR","account_id":1,"amount":96
 ```
 The invoice must be **validated** first. `mode`: `VIR|CB|CHQ|LIQ`. Customer
 payments settle the full remaining amount and mark the invoice paid; **supplier**
-payments require an explicit `amount`. `account_id` is the bank account id (the
-read-only `dolibarr-payments-state` skill lists them; `ai_agent_sandbox` does not
-yet have `banque lire`, so pass the id). Emits the new payment id.
+payments require an explicit `amount`. `account_id` is the bank account id — list
+them with `scripts/bank-accounts.sh` (`ai_agent_sandbox` now holds `banque lire`).
+Emits the new payment id.
 
 ### 4 · Credit note (avoir) — `scripts/creditnote-create.sh`
 
 ```sh
+# customer avoir
 echo '{"socid":42,"source_invoice":19,"validate":true,
        "lines":[{"desc":"Avoir partiel conseil","qty":1,"price_ht":100,"tva":20,"type":"service"}]}' \
   | scripts/creditnote-create.sh
+# supplier avoir (avoir fournisseur)
+echo '{"socid":12,"kind":"supplier","source_invoice":17,"ref_supplier":"AV-2026-77","validate":true,
+       "lines":[{"desc":"Avoir hosting","qty":1,"price_ht":120,"tva":20,"type":"service"}]}' \
+  | scripts/creditnote-create.sh
 ```
-A customer invoice of `type=2` referencing `source_invoice` (`fk_facture_source`);
-amounts come out negative (a credit). `validate:true` turns the draft into a
-numbered `AVC…` avoir. Emits `{id, ref, total_ht, total_ttc, fk_facture_source, statut}`.
+An invoice of `type=2` referencing `source_invoice` (`fk_facture_source`); amounts
+come out negative. `kind:"supplier"` targets `/supplierinvoices` (carry
+`ref_supplier`); default `customer` targets `/invoices`. `validate:true` numbers it
+(`AVC…` for customer, `AVF…` for supplier). Emits `{id, ref, ref_supplier, total_ht,
+total_ttc, fk_facture_source, statut}`.
 
 ## Promote to prod (rehearse → review → replay)
 
@@ -163,8 +170,9 @@ sandbox KissMetrics on `--target sandbox` and the prod one on `--target prod`.
   REST create needs `code_client`/`code_fournisseur = "-1"` to trigger it — the
   script does this; without it the API errors `ErrorCustomerCodeRequired`.
 - **Dates** are sent as Unix epochs; pass `date:"YYYY-MM-DD"` or omit for today.
-- **`banque lire`** isn't granted yet → `GET /bankaccounts` returns empty. Add it
-  to the provisioner's rights set if account discovery from this skill is needed.
+- **`banque lire`** (rights id 111) is granted → `scripts/bank-accounts.sh` lists
+  accounts (id/label/bank) so a payment can pick its `account_id`. It's in the
+  provisioner's `WRITE_IDS`, so a fresh `provisionSandbox.ts` run includes it.
 - **Avoirs (credit notes)** → `creditnote-create.sh` (customer invoice `type=2`
   referencing `source_invoice`; amounts negative, ref `AVC…`). Supplier avoirs
   are a follow-up.