feat: emission v1 + idempotency (Task 5)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/certificates/test_certificates.py

@@ -263,7 +263,7 @@ async def test_cross_tenant_ref_same_product_is_404(db_session):
 @pytest.mark.asyncio
 async def test_second_upload_replaces_the_first_soft_deleting_it(db_session):
     key = f"k-{uuid.uuid4().hex}"
-    await create_product(db_session, name="auto", api_key=key)
+    product = await create_product(db_session, name="auto", api_key=key)
     first_pfx = _build_test_pfx(cnpj="14200166000187", password="senha123", cn="PRIMEIRO:14200166000187")
     second_pfx = _build_test_pfx(cnpj="14200166000187", password="senha456", cn="SEGUNDO:14200166000187")
 
@@ -280,8 +280,15 @@ async def test_second_upload_replaces_the_first_soft_deleting_it(db_session):
     assert get_response.json()["id"] == second_response.json()["id"]
     assert "SEGUNDO" in get_response.json()["subject_cn"]
 
+    # `product_id` scoped -- `tenant_ref="t1"`/`branch_ref="b1"` are literals
+    # reused by MANY tests in this file/suite (the `db_session` fixture only
+    # rolls back at teardown, it does not truncate what earlier tests already
+    # committed), so an unscoped query here would count every OTHER test's
+    # certificates for the same branch_ref too.
     result = await db_session.execute(
-        select(FiscalCertificate).where(FiscalCertificate.branch_ref == "b1")
+        select(FiscalCertificate).where(
+            FiscalCertificate.product_id == product.id, FiscalCertificate.branch_ref == "b1"
+        )
     )
     rows = result.scalars().all()
     assert len(rows) == 2