feat: Hub-side plumbing for CFOP/IPPT write capability (flag DEFAULT OFF)

Missão 4 / Bloco E.1-E.2, on feature/cfop-ippt-write only (never main):

- Migration 0033_cfop_ippt_write_mode: Installation.cfop_ippt_write_mode
  (DISABLED|DRY_RUN|APPROVAL_REQUIRED|ENABLED, DEFAULT 'DISABLED' for every
  installation, existing and new) + append-only cfop_ippt_write_audits table.
- central/app/cfop_ippt_audit.py mirrors rtc_audit.py for this narrower
  capability: job_authorizations(installation) (delivered inside the
  authenticated job/heartbeat authorizations, never a local Agent switch) and
  record_cfop_ippt_write_audits (persists applied/aborted cells; only CFOP/
  IPPT are ever accepted, everything else silently ignored).
- central/app/web.py: POST /agents/{id}/cfop-ippt-write - ADMIN only (SSO
  Gerenciador), CSRF, typing GRAVAR required for any mode other than
  DISABLED, every change audited (CFOP_IPPT_WRITE_MODE). Small toggle UI in
  agent_detail.html next to Contexto Fiscal.
- Wired into the existing job/heartbeat authorization payload and job
  completion handling in central/app/api.py, alongside (never mixed with)
  the RTC wiring.
- 18 new tests (central/tests/test_cfop_ippt_write_plumbing.py): default
  DISABLED everywhere (job payload AND /v1/agents/me/authorizations); a
  forged completion payload can never change the mode (read fresh from the
  Installation row, never from Agent-supplied JSON); PADRAO role gets 403
  with no audit row; ADMIN + wrong/missing CSRF is refused; ADMIN without
  typing GRAVAR is refused (422); disabling never requires GRAVAR; invalid
  mode is refused; the audit recorder only accepts CFOP/IPPT, silently
  drops any other field (e.g. a stray CCLASSTRIB row).
- Two existing RTC tests updated for the additive authorizations-dict key
  (cfop_ippt_write_mode) they now also carry.

Still NOT wired into agent/scripts/run_agent_service.py::execute_job - no
Agent code calls select_candidates/apply_candidates yet, so nothing writes
to Firebird from this branch. That wiring, an Agent version bump, a new
installer and Windows Sandbox validation are the next step, deliberately
left for after review (see docs/CFOP_IPPT_WRITE_CAPABILITY_V1.md) - this
mission explicitly asked not to publish this as an active release yet.

FULL_SUITE on this branch: 1 known, expected failure -
test_manifest_records_the_real_migration_head - because this branch adds
migration 0033 that was never merged to master/deployed; RELEASE_MANIFEST.json
intentionally still describes master/production (head 0032). Every other
test passes, including all CFOP/IPPT and RTC-adjacent tests.

REAL_PRODUCT_FISCAL_WRITES=0 (no write path is reachable from any Agent
code on any branch).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

central/app/models.py

@@ -286,6 +286,10 @@ class Installation(Base):
     # RTC auto-apply is authorized centrally per installation and is OFF until an operator explicitly turns it on (the Agent has its own second switch).
     rtc_auto_apply_authorized: Mapped[bool] = mapped_column(Boolean, default=False, server_default="false")  # legacy (0027); rtc_write_mode is the source of truth
     rtc_write_mode: Mapped[str] = mapped_column(String(24), default="DISABLED", server_default="DISABLED")  # DISABLED | DRY_RUN | APPROVAL_REQUIRED | ENABLED
+    # Same model as rtc_write_mode, an entirely separate switch: authorizes ONLY the CFOP_IPPT_WRITE_V1
+    # capability (gti_fiscal_agent.cfop_ippt_auto_apply), never RTC. DISABLED by default for every
+    # installation - an operator must explicitly turn it on, per installation.
+    cfop_ippt_write_mode: Mapped[str] = mapped_column(String(24), default="DISABLED", server_default="DISABLED")  # DISABLED | DRY_RUN | APPROVAL_REQUIRED | ENABLED
     # Per-installation FUNCTIONS (central, no local switch). Existing installations keep working exactly as before (corrector on, features configured);
     # a NEW installation starts WAITING_FEATURE_CONFIGURATION (features_configured=False): it heartbeats but processes nothing until an admin chooses.
     corrector_enabled: Mapped[bool] = mapped_column(Boolean, default=False, server_default="true")
@@ -780,6 +784,27 @@ class RtcWriteAudit(Base):
     recorded_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now(), index=True)
 
 
+class CfopIpptWriteAudit(Base):
+    """Append-only record of every attempted C000025.CFOP/IPPT write (applied or aborted) under the
+    CFOP_IPPT_WRITE_V1 capability. Holds the old value, so each change is revertible by hand."""
+    __tablename__ = "cfop_ippt_write_audits"
+    id: Mapped[int] = mapped_column(primary_key=True)
+    tenant_id: Mapped[int] = mapped_column(ForeignKey("tenants.id"), index=True)
+    installation_id: Mapped[int] = mapped_column(ForeignKey("installations.id"), index=True)
+    agent_id: Mapped[int] = mapped_column(ForeignKey("agents.id"), index=True)
+    job_id: Mapped[int | None] = mapped_column(Integer, nullable=True, index=True)
+    product_code: Mapped[str] = mapped_column(String(64), index=True)
+    field: Mapped[str] = mapped_column(String(16))  # CFOP | IPPT only
+    outcome: Mapped[str] = mapped_column(String(16), index=True)  # APPLIED | ABORTED | FAILED | ROLLED_BACK
+    reason: Mapped[str | None] = mapped_column(String(96), nullable=True)
+    old_value: Mapped[str | None] = mapped_column(String(16), nullable=True)
+    new_value: Mapped[str | None] = mapped_column(String(16), nullable=True)
+    action: Mapped[str | None] = mapped_column(String(16), nullable=True)  # APPLY | ROLLBACK
+    rollback_of: Mapped[int | None] = mapped_column(Integer, nullable=True, index=True)
+    written_at: Mapped[str | None] = mapped_column(String(40), nullable=True)
+    recorded_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now(), index=True)
+
+
 class RtcCandidate(Base):
     """Server-side preview of the products the Agent could fill (R3 only). Rows are proposals; only the Agent's re-derivation at write time decides."""
     __tablename__ = "rtc_candidates"