Develop (#374)

* feat(fiscal): curadoria de correcao humana antes de virar dado de treino (issue #346) (#369)

- IFieldCorrectionStore: ListPendingReportsAsync, GetReportAsync, TransitionStatusAsync
  (transicao so a partir de 'pending', idempotente via WHERE Status='pending')
- SqlFieldCorrectionStore: implementacao ADO.NET + projecao FieldCorrectionReportSummary
- Endpoints em TransformationExecutionController ([Authorize(Roles="admin")], sem papel
  "fiscal" no projeto ainda - TODO #346):
    GET  /api/transformation/field-correction/pending
    POST /api/transformation/field-correction/{reportId}/review  { decision: accepted|rejected }
- So 'reviewed_accepted' gera linha JSONL incremental com source="human-correction-reviewed";
  rejected/pending nunca entram. GroundTruthXml do contexto nunca e sobrescrito.
- TrainingDataCaptureService: writer comum AppendJsonlLine + TryCaptureHumanCorrection
  (reusa path/rotacao/contador, sem duplicar File.AppendAllText)
- 14 testes novos (transicao idempotente, so accepted gera JSONL, rejected/pending nao,
  ground truth intacto, autorizacao fail-closed)

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

* fix(auth): audience M2M passa a ser o Client ID (GUID), nao o api:// URI (#371)

Token de acesso v2 do Entra (App Registration com accessTokenAcceptedVersion=2,
aplicado no manifest em 2026-09-10 para resolver o mismatch de issuer v1/v2)
traz aud = GUID do recurso, nao o Application ID URI. A validacao esperava
"api://f76c2598-..." e falhava com IDX10214 (audience validation failed) no
reteste M2M do Cypress (issue LayoutParserCypress#13).

Troca Authentication:ServiceClient:Audience de "api://f76c2598-4759-48a9-8145-8a967ec7ac96"
para "f76c2598-4759-48a9-8145-8a967ec7ac96". O identifierUris do App Registration
continua api://<guid> (e o que o consumidor pede como scope /.default) - so o aud
emitido no token v2 e o GUID puro. Comentario em appsettings.json e XML doc de
ServiceClientAuthenticationOptions.Audience atualizados.

Sem mudanca de codigo/logica - so config + doc. 24 testes de seguranca M2M/SmartAuth
seguem verdes.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: elson-vinicius-lopes