feat: deterministic cClassTrib resolver + gated CCLASSTRIB auto-apply (default OFF), RTC panel summary; 1.1.9

- resolver (rules RTC-R0..R4/A1..A3/G1..G2) over the official cClassTrib table 2026-06-22 and LC 214/2025 annexes; local vs official catalog comparison
- ONE root-cause RTC blocker per product (missing/unresolved/ambiguous/conflict/official mismatch/catalog outdated/evidence missing)
- auto-apply: C000025.CCLASSTRIB only, three switches (FIREBIRD_WRITES + RTC_AUTO_APPLY_ENABLED + Hub authorization), per-product re-read and re-decision, never overwrites, rowcount 1, audit table rtc_write_audits (migration 0027)
- copy-only write E2E (280/280 applied, only CCLASSTRIB changed, 2nd run 0 writes, stale decision 0 writes); real databases untouched
- docs: cclasstrib_resolution, rtc_auto_apply, unified_fiscal_completeness

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

central/app/web.py

@@ -296,7 +296,7 @@ def router(session_factory):
         if installation.processing_enabled and last_sync is not None:
             next_sync = last_sync + timedelta(seconds=installation.sync_interval_seconds)
         last_summary = session.scalar(select(Job.result_summary).where(Job.agent_id == agent.id, Job.status == "COMPLETED", Job.kind.in_(("INITIAL_SYNC", "SYNC_INCREMENTAL", "REPROCESS_ALL"))).order_by(Job.id.desc()).limit(1))
-        return {"rtc": rtc_status_view(last_summary), "enabled": bool(installation.processing_enabled), "interval_minutes": installation.sync_interval_seconds // 60,
+        return {"rtc": rtc_status_view(last_summary, bool(installation.rtc_auto_apply_authorized)), "rtc_authorized": bool(installation.rtc_auto_apply_authorized), "enabled": bool(installation.processing_enabled), "interval_minutes": installation.sync_interval_seconds // 60,
                 "last_sync": format_ui_datetime(last_sync) if last_sync else None, "next_sync": format_ui_datetime(next_sync) if next_sync else None,
                 "last_changed": installation.last_sync_changed, "last_job": {"kind": last_job.kind, "status": last_job.status, "id": last_job.id, "kind_label": job_kind_label(last_job.kind), "status_label": job_status_label(last_job.status)} if last_job else None}
 
@@ -319,6 +319,32 @@ def router(session_factory):
             return RedirectResponse(f"/agents/{agent_id}?tab=jobs", status_code=303)
         finally: session.close()
 
+    @routes.post("/agents/{agent_id}/rtc-auto-apply")
+    async def rtc_auto_apply_authorization(request: Request, agent_id: int):
+        """Central authorization of the automatic cClassTrib fill (default OFF). Enabling requires an explicit typed confirmation; every change is audited."""
+        session, auth_data, redirect = page_auth(request)
+        if redirect: return redirect
+        try:
+            values = await form_values(request); web_session, admin = auth_data
+            require_csrf(web_session, values.get("csrf_token"))
+            agent = session.get(Agent, agent_id)
+            installation = session.scalar(select(Installation).where(Installation.agent_id == agent_id)) if agent else None
+            if not agent or not installation: return HTMLResponse("Agent not found", status_code=404)
+            decision = values.get("decision")
+            if decision == "authorize":
+                if (values.get("confirm") or "").strip().upper() != "PREENCHER":
+                    return HTMLResponse("Digite PREENCHER para confirmar a autorização", status_code=422)
+                installation.rtc_auto_apply_authorized = True
+            elif decision == "revoke":
+                installation.rtc_auto_apply_authorized = False
+            else:
+                return HTMLResponse("decisão inválida", status_code=422)
+            record_audit(session, admin_user_id=admin.id, tenant_id=installation.tenant_id, action=f"RTC_AUTO_APPLY_{decision.upper()}", target_type="installation", target_id=installation.installation_id,
+                         context={"authorized": installation.rtc_auto_apply_authorized}, severity="WARNING")
+            session.commit()
+            return RedirectResponse(f"/agents/{agent_id}", status_code=303)
+        finally: session.close()
+
     @routes.post("/agents/{agent_id}/sync-now")
     async def sync_now(request: Request, agent_id: int):
         return await _installation_action(request, agent_id, "sync-now")