feat: connect Tiny through its v3 API with OAuth

Tiny v3 replaces the v2 token adapter. An operator connects Tiny once from
the Kanban; the callback is authorised by a single-use state, because Tiny's
cross-site redirect does not carry the SameSite=Strict operator cookie.
Tokens are kept in provider_tokens, the refresh token rotates under a row
lock, and the worker keeps the connection alive while order creation is off.

Orders find or create the customer's contact by CNPJ, then POST /pedidos
with product ids from TINY_PRODUCT_TEXTIL_FOLHA, _TEXTIL_AVULSA, _UV_FOLHA
and _UV_AVULSA and numeroOrdemCompra DTF-<number>; a retry searches the
customer's recent orders for that number first. The product settings avoid a
_FILE suffix, which the secrets loader reads as a secret file path.

Production passes the application credentials through but keeps
TINY_ADAPTER fake: Tiny has no sandbox, so creating real orders waits for a
supervised test. compose.providers.yaml gives the local API and worker an
internet route for provider testing; the default local stack still has none.

Verified with the full CI integration sequence locally, including the new
tiny_oauth_test against the real database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.env.example

@@ -25,9 +25,18 @@ TINY_ADAPTER=fake
 # MP_ACCESS_TOKEN=TEST-...
 # MP_WEBHOOK_SECRET=...
 # MP_NOTIFICATION_URL=https://<public tunnel>/api/payments/webhook
-# TINY_ADAPTER=tiny
-# TINY_TOKEN=...
-# TINY_TAG=Site DTF
+# Tiny API v3: client ID/secret come from the "Aplicativo" created in Tiny
+# (Configurações > Geral > Aplicativos); the redirect URI registered there
+# must be exactly TINY_REDIRECT_URI. Product ids are the Tiny products each
+# Site product becomes. Tiny has no sandbox: orders created are real.
+# TINY_CLIENT_ID=...
+# TINY_CLIENT_SECRET=...
+# TINY_REDIRECT_URI=http://localhost:8081/api/operator/tiny/callback
+# TINY_PRODUCT_TEXTIL_FOLHA=...
+# TINY_PRODUCT_TEXTIL_AVULSA=...
+# TINY_PRODUCT_UV_FOLHA=...
+# TINY_PRODUCT_UV_AVULSA=...
+# TINY_ADAPTER=tiny      # only once connected and tested: creates real orders
 WHATSAPP_ADAPTER=fake
 STORAGE_ADAPTER=s3-local
 MOCK_FREIGHT_CENTS=1500