feat: certificates + series API v1 (Task 4)

Port certificate lifecycle (parse/encrypt/upload/deactivate) and
FiscalSeries CRUD from the auto, adapted to (product_id, tenant_ref,
branch_ref) tenancy. Closes the "guard retroativo" PATCH /v1/series
next_number regression check that Task 3 deferred to this task.

Routes: POST/GET/DELETE /v1/certificados, POST/GET/PATCH /v1/series.

.env.example

@@ -1,2 +1,8 @@
 DATABASE_URL=postgresql+asyncpg://postgres:postgres@localhost:5432/fiscal_svc_dev
 TEST_DATABASE_URL=postgresql+asyncpg://postgres:postgres@localhost:5432/fiscal_svc_test
+
+# Fernet key for A1 certificate ciphertext at rest (certificates.crypto,
+# Task 4) -- read straight from os.environ, never through Settings (same
+# "secrets don't live in Settings" convention as the auto). Generate one
+# with: python -c "from cryptography.fernet import Fernet; print(Fernet.generate_key().decode())"
+FISCAL_CERT_ENCRYPTION_KEY=