[FIX] Simulazione: warning residui + provision JWT standard

- ServicesController::provision(): JWT usa user_id (standard requireAuth)
- simulate-nis2.php: classifyOrg null-safe per entity_type
- simulate-nis2.php: completeOnboarding usa PUT /organizations/{id}
  invece di /onboarding/complete (evita 409 quando org già esiste)
- simulate-nis2.php: supplier.critical rimosso da $supDef (was extra field)
- EmailService: rimosso sent_at (non in email_log schema)
- WebhookService: status ?? 'detected' (null-safe)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

application/controllers/ServicesController.php

@@ -654,14 +654,9 @@ class ServicesController extends BaseController
         // ── 7. JWT accesso immediato (2h) ────────────────────────────────
         $issuedAt = time();
         $jwtPayload = [
-            'iss'     => 'nis2.agile.software',
-            'sub'     => $userId,
-            'org_id'  => $orgId,
-            'role'    => 'super_admin',
-            'provisioned' => true,
-            'iat'     => $issuedAt,
-            'exp'     => $issuedAt + 7200,
-            'type'    => 'access',
+            'user_id'     => $userId,   // campo standard atteso da requireAuth()
+            'iat'         => $issuedAt,
+            'exp'         => $issuedAt + JWT_EXPIRES_IN,
         ];
         $h   = $this->base64UrlEncode(json_encode(['alg' => 'HS256', 'typ' => 'JWT']));
         $p   = $this->base64UrlEncode(json_encode($jwtPayload));