feat: single sign-on from the panel into GTI Fiscal

The sidebar "Fiscal" entry now goes to /sso/fiscal. For a logged-in,
active employee the panel issues a JWT signed with Ed25519 (the private
key exists only here; GTI Fiscal only holds the public key): iss/aud
fixed, sub = funcionario:<ID> (LOGIN is editable), 60 s lifetime, unique
jti that GTI Fiscal records to reject replays. No password, hash or panel
cookie leaves the panel.

The assertion is delivered in an auto-submitted POST, never in the URL,
so it stays out of proxy logs, browser history and Referer. That page
carries its own CSP allowing form-action only to the configured callback
origin; the security-headers middleware now keeps a route-defined CSP.

Without a session the employee goes through the normal login and comes
back; plain HTTP is redirected to the public HTTPS address; `next` only
accepts a relative path; the .env bootstrap account (no stable ID) is
refused.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/main.py

@@ -12,7 +12,7 @@ from . import session
 from .asset_versao import ASSET_VERSAO
 from .auth import NaoAutenticado, UsuarioLogado, exigir_login
 from .csrf import CSRF_COOKIE_NAME, gerar_token
-from .routers import auth, chave_manual, clientes, contatos, funcionarios, log, minha_conta
+from .routers import auth, chave_manual, clientes, contatos, funcionarios, log, minha_conta, sso
 
 app = FastAPI(title="Painel de Clientes", docs_url=None, redoc_url=None, openapi_url=None)
 app.mount("/static", StaticFiles(directory="app/static"), name="static")
@@ -23,6 +23,7 @@ app.include_router(chave_manual.router)
 app.include_router(funcionarios.router)
 app.include_router(minha_conta.router)
 app.include_router(log.router)
+app.include_router(sso.router)
 
 
 @app.exception_handler(NaoAutenticado)
@@ -76,15 +77,18 @@ async def security_headers_middleware(request: Request, call_next):
     response.headers["X-Content-Type-Options"] = "nosniff"
     response.headers["X-Frame-Options"] = "DENY"
     response.headers["Referrer-Policy"] = "same-origin"
-    response.headers["Content-Security-Policy"] = (
-        "default-src 'self'; "
-        "script-src 'self' 'unsafe-inline'; "
-        "style-src 'self' 'unsafe-inline'; "
-        "img-src 'self' data:; "
-        "frame-ancestors 'none'; "
-        "base-uri 'self'; "
-        "form-action 'self'"
-    )
+    # Uma rota pode definir a própria CSP, mais restrita (hoje só /sso/fiscal,
+    # que precisa de form-action para a origem do Fiscal); as demais recebem esta.
+    if "content-security-policy" not in response.headers:
+        response.headers["Content-Security-Policy"] = (
+            "default-src 'self'; "
+            "script-src 'self' 'unsafe-inline'; "
+            "style-src 'self' 'unsafe-inline'; "
+            "img-src 'self' data:; "
+            "frame-ancestors 'none'; "
+            "base-uri 'self'; "
+            "form-action 'self'"
+        )
     if request.url.scheme == "https":
         response.headers["Strict-Transport-Security"] = "max-age=31536000; includeSubDomains"
     return response