fix(certificates): scope the live certificate uniquely per tenant, not just per branch_ref

IMPORTANT (F2 review): certificate is per-tenant, matching series (already
tenant-scoped) and the GET/DELETE anti-oracle boundary. Emission's
_get_live_certificate and the upload-replace pre-check (certificates.
service, renamed _get_live_certificate_by_branch ->
_get_live_certificate_by_tenant_branch) both omitted tenant_ref -- two
tenants of one product reusing branch_ref="matriz" collapsed onto the same
slot: B's upload soft-deleted A's still-live certificate, and A's emission
went on to sign with B's certificate.

Migration 8f1a2c9d4b6e replaces the partial-unique index
ix_fiscal_certificates_product_branch_live with
ix_fiscal_certificates_product_tenant_branch_live on
(product_id, tenant_ref, branch_ref) WHERE deleted_at IS NULL, with a
working downgrade. Upload's two-layer defense (pre-check + IntegrityError ->
CertificateUploadConflictError) still holds against the new index.

Tests:
- tests/emission/test_emissao.py::
  test_dois_tenants_do_mesmo_produto_reusando_branch_ref_tem_certificados_isolados
  -- two tenants upload for the same product/branch_ref, both stay live;
  emission for each signs with its OWN certificate (observable via FIX 1's
  CNPJ check: without FIX 2, tenant A's emission would 409
  emitente_certificate_cnpj_mismatch because the "live" cert would
  actually be B's).
- tests/migrations/test_fiscal_documents_schema.py::
  test_two_tenants_can_both_hold_a_live_certificate_for_the_same_branch_ref_on_real_migration
  -- real alembic upgrade head, raw INSERTs proving both tenants' certs
  land live.
- tests/migrations/test_fiscal_documents_schema.py::
  test_two_live_certificates_for_same_product_tenant_branch_violate_unique_index_on_real_migration
  (renamed from ..._product_branch_...) -- same (product, tenant, branch)
  still rejects a second live certificate on the real migration.
- tests/certificates/test_certificates.py::
  test_concurrent_uploads_for_same_product_branch_only_one_wins_the_other_gets_409
  updated for the renamed/re-scoped precheck function (still same-tenant
  race, still 1 winner + 1 CertificateUploadConflictError).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/emission/test_emissao.py

@@ -410,6 +410,71 @@ async def test_emitente_cnpj_divergente_do_certificado_e_409_e_nao_queima_numero
     assert success_response.json()["numero"] == raw["numero"]
 
 
+# --- FIX 2 (F2 review): certificado é POR TENANT, não só por branch_ref -----
+
+
+@pytest.mark.asyncio
+async def test_dois_tenants_do_mesmo_produto_reusando_branch_ref_tem_certificados_isolados(db_session):
+    """Antes do FIX 2, `_get_live_certificate` (emissão) e o pre-check de
+    upload omitiam `tenant_ref` -- dois tenants do MESMO produto reusando o
+    MESMO `branch_ref` opaco ("matriz", plausível: refs são strings livres
+    do produto chamador) colapsavam no MESMO slot. O upload do tenant B
+    soft-deletava o certificado ainda vivo do tenant A (replace
+    "legítimo"), e a emissão do tenant A passava a resolver o certificado
+    de B.
+
+    A prova combina FIX 1 (CNPJ do emitente vs certificado) para tornar o
+    vínculo OBSERVÁVEL: sem o FIX 2, o certificado "vivo" para `branch_ref
+    ="matriz"` seria o de B (CNPJ_B) para AMBOS os tenants -- a emissão do
+    tenant A com `emitente.cnpj`=CNPJ_A bateria no FIX 1 e devolveria 409
+    `emitente_certificate_cnpj_mismatch` em vez de 201."""
+    cnpj_a = "11222333000181"
+    cnpj_b = "44555666000107"
+    product, key = await _product_and_key(db_session)
+    payload_a, raw_a = _payload_from_golden(
+        "caso_padrao_intra", tenant_ref="tenant-a", branch_ref="matriz"
+    )
+    payload_a["emitente"] = {**payload_a["emitente"], "cnpj": cnpj_a}
+    payload_b, raw_b = _payload_from_golden(
+        "caso_padrao_inter", tenant_ref="tenant-b", branch_ref="matriz"
+    )
+    payload_b["emitente"] = {**payload_b["emitente"], "cnpj": cnpj_b}
+
+    transport = ASGITransport(app=app)
+    async with AsyncClient(transport=transport, base_url="http://test") as client:
+        await _setup_certificate_and_series(
+            db_session, client, key, tenant_ref="tenant-a", branch_ref="matriz",
+            serie=raw_a["serie"], next_number=raw_a["numero"], cnpj=cnpj_a,
+        )
+        # Segundo upload, MESMO produto, MESMO branch_ref, tenant DIFERENTE.
+        await _setup_certificate_and_series(
+            db_session, client, key, tenant_ref="tenant-b", branch_ref="matriz",
+            serie=raw_b["serie"], next_number=raw_b["numero"], cnpj=cnpj_b,
+        )
+
+        # O certificado de A segue vivo (GET de A não foi soft-deletado
+        # pelo upload de B) -- prova direta, sem depender do FIX 1.
+        get_a = await client.get(
+            "/v1/certificados",
+            params={"tenant_ref": "tenant-a", "branch_ref": "matriz"},
+            headers=_headers(key),
+        )
+        assert get_a.status_code == 200, get_a.text
+        assert get_a.json()["cnpj_certificado"] == cnpj_a
+
+        emit_a = await client.post(
+            "/v1/emissoes", json=payload_a,
+            headers={**_headers(key), "Idempotency-Key": f"idem-a-{uuid.uuid4().hex}"},
+        )
+        emit_b = await client.post(
+            "/v1/emissoes", json=payload_b,
+            headers={**_headers(key), "Idempotency-Key": f"idem-b-{uuid.uuid4().hex}"},
+        )
+
+    assert emit_a.status_code == 201, emit_a.text
+    assert emit_b.status_code == 201, emit_b.text
+
+
 # --- prova do outbox --------------------------------------------------------