[FIX] SIM-06 + EmailService + WebhookService + supplier assessment

- ServicesController::provision(): created_by usa userId (INT) non string
- EmailService::logEmail(): rimosso sent_at (colonna non esiste in email_log)
- WebhookService::incidentPayload(): status ?? 'detected' (null-safe)
- simulate-nis2.php: supplier assessment usa formato assessment_responses
  corretto [{question, weight, value: yes|partial|no}]

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

application/controllers/ServicesController.php

@@ -647,7 +647,7 @@ class ServicesController extends BaseController
                 $orgId, $keyName, $keyPrefix, $keyHash,
                 json_encode(['read:all', 'write:all', 'admin:org', 'sso:login']),
                 $expiresAt,
-                'provision:' . ($caller['system'] ?? 'external'),
+                $userId,  // created_by: admin utente provisioned
             ]
         );