fix: Ensure transport certificates are available during DANFSE artifact storage

[vitormattos]

Problem

In production, DANFSE (PDF) generation failed with:

file_get_contents(): Unable to set local cert chain file '/dev/shm/nfse_tls_cert_*'

Users saw "Indisponível" (unavailable) for the DANFSE PDF while the NFS-e was successfully emitted.

Root Cause

Transport certificates were created in temporary files (/dev/shm/nfse_tls_cert_*) for mTLS requests to the gateway. However, the cleanup closure was being called too early - before storeArtifacts() completed.

Timeline (buggy flow):

1. makeClient() creates cert files and stores cleanup closure
2. try block completes (emit/query/authorize)
3. finally block calls cleanup (DELETES cert files!) ← BUG
4. storeArtifacts() calls getDanfse() which needs certs ← FAILS

The error comes from cURL/OpenSSL trying to read the certificate file that was already deleted.

Solution

1. TransportCertificateManager: Add fallback directory strategy

• If /dev/shm unavailable (read-only container, permission issues), fallback to sys_get_temp_dir()
• Better error messaging listing both checked directories
• Handles production environments where /dev/shm may be restricted

2. InvoiceController: Move cleanup to AFTER client usage completes

Affected methods:

• emit(): Wrap storeArtifacts() and post-processing in try/finally AFTER emission completes
• refresh(): Wrap storeArtifacts() in try/finally AFTER query completes
• reemit(): Wrap storeArtifacts() in try/finally AFTER reissuance completes
• cancel(): Already safe (doesn't use client after exception handling)

This ensures getDanfse() (and any other client operations) complete before certificate cleanup occurs.

Testing

• Added TransportCertificateCleanupTest to validate that getDanfse() is called before cleanup
• Existing tests continue to pass
• Code flow now matches implementation requirements

Changes

• ✅ Improved temporary directory resolution with fallback logic
• ✅ Fixed cleanup sequencing in 3 methods (emit, refresh, reemit)
• ✅ Added comprehensive test case for certificate lifecycle
• ✅ Signed commit with detailed explanation