feat(ksef): add KSeF 2.0 e-invoicing integration

[hedon77]

What

KSeF 2.0 e-invoicing integration as an addon: hands paid VAT invoices to the Polish National e-Invoicing System and shows their status with retry/correction.

• XAdES (ECDSA) challenge-response authentication via qualified seal/signature.
• FA(2) XML invoice generation.
• AES-256-CBC invoice encryption + RSA-OAEP SHA-256 key wrap.
• Async submission (\SubmitInvoiceJob\ + scheduler), status polling, resend, correction, module log, API connection test.
• Only submits VAT invoices (skips proformas).

Dependency

• Depends on feat(addons): generic per-addon settings store (AddonSetting + addon_settings + settings UI) #22 (generic addon settings store). Merge feat(addons): generic per-addon settings store (AddonSetting + addon_settings + settings UI) #22 first.
• No longer depends on the Company Lookup (feat(company-lookup): add NIP company lookup (GUS, MF, CEIDG, OpenBRIS) #19) addon.

[hedon77]

Review

KSeF addon. Verified: no Company Lookup dependency — diff has framework + KSeF only, no \modules/CompanyLookup/*.

Sugestia: zmerguj #22 najpierw, potem rebase tego PR.

[Panelica]

Thank you — the KSeF 2.0 work (XAdES signing, RSA-OAEP-SHA256, the background submission job) is superb. We just merged the first clean batch into main: #16 (client delete), #24 (invoice number display), #13 (Tpay), #22 (addon settings framework) and #14 (tax rewrite). Since this builds on the addon framework we just merged (#22), it now conflicts with main. A rebase on the updated main should clear the overlap, then we'll merge. Great contribution.

[hedon77]

*Zrebasowane na aktualny \main* — czyste, gotowe do merga.

Odpowiedź na uwagi z review #21:

• *\exec('openssl pkeyutl …')* w \Crypto::rsaOaepSha256(): usunięty. OAEP-SHA256 (i MGF1-SHA256) realizowane teraz w czystym PHP przez phpseclib3 — dodane jako bezpośrednia zależność (\phpseclib/phpseclib: ^3.0\ w \composer.json). Żadnego wywoływania zewnętrznego \openssl\ ani plików tymczasowych; działa na FPM z \disable_functions=exec,....
• Weryfikacja: round-trip — dane zaszyfrowane nową metodą są poprawnie odszyfrowywane przez \openssl pkeyutl -decrypt\ z parametrami KSeF (
  sa_oaep_md:sha256 rsa_mgf1_md:sha256) → \MATCH: YES.
• Migracje: diff zawiera tylko własne \