[FIX] Simulazione: warning residui + provision JWT standard

- ServicesController::provision(): JWT usa user_id (standard requireAuth)
- simulate-nis2.php: classifyOrg null-safe per entity_type
- simulate-nis2.php: completeOnboarding usa PUT /organizations/{id}
  invece di /onboarding/complete (evita 409 quando org già esiste)
- simulate-nis2.php: supplier.critical rimosso da $supDef (was extra field)
- EmailService: rimosso sent_at (non in email_log schema)
- WebhookService: status ?? 'detected' (null-safe)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

simulate-nis2.php

@@ -286,12 +286,20 @@ function ensureOrg(string $jwt, array $data): ?int
     return null;
 }
 
-/** Completa onboarding org. */
+/** Aggiorna dati org (onboarding simulato). */
 function completeOnboarding(string $jwt, int $orgId, array $data): void
 {
-    $res = api('POST', '/onboarding/complete', $data, $jwt, $orgId);
-    if (apiOk($res, 'onboarding')) {
-        ok("Onboarding completato org #$orgId");
+    // La sim crea l'org via ensureOrg, poi usa PUT per aggiornare i dati
+    // (evita il 409 di /onboarding/complete che presuppone wizard da zero)
+    $updateData = [];
+    if (isset($data['employee_count']))      $updateData['employee_count'] = $data['employee_count'];
+    if (isset($data['annual_turnover_eur'])) $updateData['annual_turnover_eur'] = $data['annual_turnover_eur'];
+    if (isset($data['vat_number']))          $updateData['vat_number'] = $data['vat_number'];
+    if (!empty($updateData)) {
+        $res = api('PUT', "/organizations/{$orgId}", $updateData, $jwt, $orgId);
+        if (apiOk($res, 'org.update')) {
+            ok("Dati org aggiornati: #$orgId");
+        }
     }
 }
 
@@ -300,7 +308,8 @@ function classifyOrg(string $jwt, int $orgId, array $data): void
 {
     $res = api('POST', '/organizations/classify', $data, $jwt, $orgId);
     if (apiOk($res, 'classify')) {
-        ok("Classificazione NIS2: {$data['nis2_type']} — Settore: {$data['sector']}");
+        $entityType = $res['data']['entity_type'] ?? ($data['nis2_type'] ?? '?');
+        ok("Classificazione NIS2: {$entityType} — Settore: {$data['sector']}");
     }
 }