feat: add KSeF invoice submission flow

[kcem]

Adds KSeF sales invoice submission flow.

What is included:

• new bin/lms-ksef.php script for sending eligible sales invoices to KSeF and synchronizing pending KSeF statuses/UPO files;
• KSeF submission from invoice list, for one invoice or selected invoices;
• KSeF submission service using n1ebieski/ksef-php-client;
• storage of KSeF document status, KSeF number and UPO content using existing KSeF tables/storage layout;
• MySQL migration making ksefdocuments.permanent_storage_date nullable, matching PostgreSQL and allowing pending outbound documents before KSeF returns permanent storage date;
• tests for config parsing, submission flow, KSeF client mapping and UPO storage.

lms-ksef.php usage:

• bin/lms-ksef.php --send sends eligible invoices.
• bin/lms-ksef.php --sync synchronizes pending documents and downloads UPO files when available.
• bin/lms-ksef.php --send --sync sends invoices and then synchronizes pending documents.
• bin/lms-ksef.php --test --send prints send candidate count only.
• bin/lms-ksef.php --test --sync prints pending document count only.
• bin/lms-ksef.php --section=<section> reads configuration from a custom uiconfig section; default is ksef.
• bin/lms-ksef.php --division=<shortname> limits send/sync to one division.
• bin/lms-ksef.php --customerid=<id> limits send/sync to one customer.

Practical use:

• configure ksef.environment and authentication first (ksef.token with ksef.auth_method=token, or ksef.certificate/ksef.password with ksef.auth_method=certificate);
• run bin/lms-ksef.php --test --send to check how many invoices are eligible before sending anything;
• run bin/lms-ksef.php --send --sync from cron to send eligible invoices and immediately try to collect statuses/UPO files using the same sync flow as invoice-list submission;
• sync waits for KSeF invoice references with backoff 1s, 2s, 3s, 5s, 10s and then keeps retrying every 10s up to 10 minutes per KSeF session;
• run bin/lms-ksef.php --sync from cron as a follow-up job if KSeF has not returned final statuses/UPO files during the send run;
• use --division=<shortname> when each division has separate KSeF credentials configured in uiconfig;
• use --customerid=<id> for controlled troubleshooting of one customer.

KSeF uiconfig options used by this flow:

• ksef.environment: KSeF environment. Supported values: test, demo, prod, production. Numeric aliases are also accepted: 1=test, 2=production, 3=demo. Default: test.
• ksef.auth_method: authentication method. Supported values: token, certificate. If not set, token auth is selected when ksef.token is present, otherwise certificate auth is selected.
• ksef.token: token used when auth_method=token.
• ksef.certificate: certificate path used when auth_method=certificate. Relative paths are resolved against SYS_DIR.
• ksef.password: certificate password used when auth_method=certificate.
• ksef.max_documents: maximum number of documents processed in one script run. Default: 10000; clamped to 1..10000.
• ksef.invoice_reference_page_size: page size for KSeF invoice reference listing during sync. Default: 1000; clamped to 10..1000.
• ksef.delay: minimum invoice age in seconds before it is eligible for KSeF submission. Default: 3600; -1 disables submission for the division.
• ksef.boundary_date: earliest invoice date eligible for KSeF submission. Default: 2026/04/01.
• ksef.all_consumers: when enabled, consumer invoices are eligible too. When disabled, only company invoices and customers with KSeF invoice consent are eligible.
• ksef.show_balance_summary: adds balance summary information to generated KSeF invoice XML.
• ksef.xml_add_all_values: adds optional XML values supported by the existing KSeF invoice XML builder.

Existing KSeF options like ksef.offline_support, ksef.offline_certificate, ksef.offline_password, ksef.invoice_header and ksef.purchase_invoice_default_order are not changed by this submission flow.

Test coverage:

• config parsing;
• submission flow;
• KSeF client mapping;
• UPO storage.