feat: connect Tiny through its v3 API with OAuth

Tiny v3 replaces the v2 token adapter. An operator connects Tiny once from
the Kanban; the callback is authorised by a single-use state, because Tiny's
cross-site redirect does not carry the SameSite=Strict operator cookie.
Tokens are kept in provider_tokens, the refresh token rotates under a row
lock, and the worker keeps the connection alive while order creation is off.

Orders find or create the customer's contact by CNPJ, then POST /pedidos
with product ids from TINY_PRODUCT_TEXTIL_FOLHA, _TEXTIL_AVULSA, _UV_FOLHA
and _UV_AVULSA and numeroOrdemCompra DTF-<number>; a retry searches the
customer's recent orders for that number first. The product settings avoid a
_FILE suffix, which the secrets loader reads as a secret file path.

Production passes the application credentials through but keeps
TINY_ADAPTER fake: Tiny has no sandbox, so creating real orders waits for a
supervised test. compose.providers.yaml gives the local API and worker an
internet route for provider testing; the default local stack still has none.

Verified with the full CI integration sequence locally, including the new
tiny_oauth_test against the real database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -25,7 +25,18 @@ x-app-environment: &app-environment
   # when the provider is configured, never to a value anyone could guess.
   PAYMENT_WEBHOOK_SECRET: ${PAYMENT_WEBHOOK_SECRET:-}
   FREIGHT_ADAPTER: fake
+  # Order creation in Tiny stays off until it has been tested against the
+  # client's account (Tiny has no sandbox). The application credentials can be
+  # set now: they let an operator connect Tiny from the Kanban, and the worker
+  # keeps that connection alive. Callback: https://<KANBAN_DOMAIN>/api/operator/tiny/callback
   TINY_ADAPTER: fake
+  TINY_CLIENT_ID: ${TINY_CLIENT_ID:-}
+  TINY_CLIENT_SECRET: ${TINY_CLIENT_SECRET:-}
+  TINY_REDIRECT_URI: ${TINY_REDIRECT_URI:-}
+  TINY_PRODUCT_TEXTIL_FOLHA: ${TINY_PRODUCT_TEXTIL_FOLHA:-}
+  TINY_PRODUCT_TEXTIL_AVULSA: ${TINY_PRODUCT_TEXTIL_AVULSA:-}
+  TINY_PRODUCT_UV_FOLHA: ${TINY_PRODUCT_UV_FOLHA:-}
+  TINY_PRODUCT_UV_AVULSA: ${TINY_PRODUCT_UV_AVULSA:-}
   WHATSAPP_ADAPTER: fake
   STORAGE_ADAPTER: s3-r2
   PUBLIC_ORIGIN: https://${SITE_DOMAIN:?set SITE_DOMAIN}