feat: read-only internal endpoint for GTI Fiscal to mirror clients

GET /internal/fiscal/clients returns every CLIENTE (active and inactive)
as {external_client_id, code, display_name, active} — CLIENTE.ID is the
identity (CODIGO is editable, same reasoning as FUNCIONARIO_PAINEL.ID in
SSO). Authenticated by a dedicated bearer token (FISCAL_INTERNAL_API_TOKEN,
never reused from SESSION_SECRET/SSO key/admin password), rate-limited per
IP, returns 503 rather than opening anonymously when the token isn't
configured. GTI Gerenciador stays the single source of truth: the Fiscal
Hub never receives MySQL credentials.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

app/main.py

@@ -12,6 +12,7 @@ from . import session
 from .asset_versao import ASSET_VERSAO
 from .auth import NaoAutenticado, UsuarioLogado, exigir_login
 from .csrf import CSRF_COOKIE_NAME, gerar_token
+from . import internal_fiscal
 from .routers import auth, chave_manual, clientes, contatos, funcionarios, log, minha_conta, sso
 
 app = FastAPI(title="Painel de Clientes", docs_url=None, redoc_url=None, openapi_url=None)
@@ -23,6 +24,7 @@ app.include_router(chave_manual.router)
 app.include_router(funcionarios.router)
 app.include_router(minha_conta.router)
 app.include_router(log.router)
+app.include_router(internal_fiscal.router)
 app.include_router(sso.router)