[INTEG] Provisioning B2B automatico + fix JWT helpers
- POST /api/services/provision: onboarding automatico tenant da lg231
- X-Provision-Secret auth (master secret, non org-specific)
- Crea org (con tutti i dati lg231: P.IVA, ATECO, sede, PEC, fatturato)
- Crea admin user con password temporanea (must_change_password=1)
- Genera API Key scope [read:all, write:all, admin:org, sso:login]
- Emette JWT 2h per apertura immediata UI
- Callback webhook a lg231 con api_key
- Idempotent: stessa P.IVA → restituisce org esistente
- Audit: org.provisioned severity=critical
- config.php: PROVISION_SECRET (env var)
- BaseController: base64UrlEncode/Decode da private → protected
- Migration 011: colonne provisioning + must_change_password + indexes
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
6933e1d3fb