Bills import: degrade gracefully when Buildium API key lacks Vendors permission

GET /v1/vendors 403s on keys without the Vendors scope; import bills without
vendor links instead of failing the pull, and surface it in results.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

supabase/functions/buildium-sync/index.ts

@@ -2096,8 +2096,17 @@ Deno.serve(async (req) => {
     if (syncType === "bills") {
       const { bIdToLocalId } = await getAssociationMaps();
 
-      // 1) Sync vendors so bills can be linked
-      const buildiumVendors = await buildiumFetchAll("/v1/vendors", clientId, clientSecret);
+      // 1) Sync vendors so bills can be linked. The Buildium API key may lack
+      // the Vendors permission (403) — degrade gracefully: import bills without
+      // vendor links instead of failing the whole pull.
+      let buildiumVendors: any[] = [];
+      let vendorsAccessible = true;
+      try {
+        buildiumVendors = await buildiumFetchAll("/v1/vendors", clientId, clientSecret);
+      } catch (e) {
+        vendorsAccessible = false;
+        console.warn(`[bills] vendors fetch failed — continuing without vendor sync: ${e}`);
+      }
       // Paginated fetch so large vendor sets don't get truncated at 1000 rows
       const existingVendors: any[] = [];
       {
@@ -2770,6 +2779,7 @@ Deno.serve(async (req) => {
         payments_held: paymentsHeld,
         checks_created: checksCreated,
         checks_held: checksHeld,
+        ...(vendorsAccessible ? {} : { vendors_unavailable: "Buildium API key lacks the Vendors permission — bills imported without vendor links" }),
       };
 
       await supabase.from("company_settings").upsert(