feat(amendment): soccorso istruttorio v3 — base dati + endpoint CRUD + internal BE

ROUND 1 della replica soccorso istruttorio speculare al BE Gepafin
bflows-bandi-be. Pacchetto base pronto, mancano scheduler/upload/email/FE
che vengono in round successivi.

==ARCHITETTURA DECISA CON CARLO==
- multi-tenancy lato BE: microservizio resta tenant-agnostic
- BE (bflows-bandi-be) fa polling sul nostro /internal e invia PEC/protocollo
  tenant-aware (hub=1 Gepafin PEC_SERVICE, hub=2 SviluppUmbria MAILGUN_SERVICE)
- microservizio NON fa PEC ne protocollo, NON conosce hub_id
- endpoint interni autenticati via shared secret X-Internal-Secret

==MIGRATION DB (2)==
mig 7: ALTER TABLE remission_amendment_request ADD
  response_days, extended_days, extension_date, internal_note,
  amendment_document_path/type, amendment_initial_document_path,
  response_document_path/type, protocol_id, email_log_id, user_action_id,
  pec_sent_at, pec_failed_reason, pec_retry_after
  + 2 index partial (status pec-pending, deadline scadenti)

mig 8: nuova tabella remission_expiration_config (type, interval_days,
  is_deleted) per reminder data-driven speculare a expiration_config BE.
  Seeded con (AMENDMENT, 7) e (AMENDMENT, 2).

==MODELLI==
- RemissionAmendmentRequest esteso con 13 colonne nuove
- RemissionExpirationConfig nuovo

==SCHEMAS==
- AmendmentStatus enum (DRAFT, AWAITING, RESPONSE_RECEIVED, EXPIRED, CLOSED)
- AmendmentRequestCreate esteso (response_days, internal_note)
- AmendmentRequestUpdate nuovo (solo DRAFT)
- AmendmentExtend nuovo (proroga)
- AmendmentPendingPecOut, AmendmentPecDetail (per BE polling)
- MarkPecSent, MarkPecFailed (callback BE)

==ENDPOINT ISTRUTTORE (estesi o nuovi)==
- POST /{pid}/amendment              crea DRAFT (modifica: non piu AWAITING diretto)
- PUT  /{pid}/amendment/{id}         modifica solo DRAFT [NUOVO]
- DELETE /{pid}/amendment/{id}       elimina solo DRAFT [NUOVO]
- POST /{pid}/amendment/{id}/send    DRAFT -> AWAITING [NUOVO]
- POST /{pid}/amendment/{id}/extend  proroga deadline [NUOVO]
- POST /{pid}/amendment/{id}/reminder reminder manuale (flag pec_retry_after) [NUOVO]
- POST /{pid}/amendment/{id}/close   chiude (AmendmentStatus enum al posto di stringhe)
- POST /{pid}/amendment/{id}/respond-beneficiary  benef risponde

==ENDPOINT INTERNI /internal/remission-amendments (nuovi)==
- GET     ?status=pending-pec|pending-reminder&since=
- GET     /{id}                        detail per composizione PEC
- POST    /{id}/mark-pec-sent          callback BE success
- POST    /{id}/mark-pec-failed        callback BE failure
Auth: X-Internal-Secret header, 401 altrimenti.

==CONFIG==
RENDIC_INTERNAL_SECRET env var (default sandbox hard-coded).

==TEST E2E==
/tmp/test_amendment_v3.py - 10 step tutti verdi:
  A reset T2 UNDER_REVIEW
  B create DRAFT (response_days=15 default)
  C update DRAFT (response_days=20, internal_note)
  D send DRAFT->AWAITING, pratica AWAITING_AMENDMENT
  E BE poll pending-pec vede amendment
  F BE detail+mark-pec-sent salva protocol_id/email_log_id/user_action_id
  G dopo mark-pec-sent scompare da pending-pec
  H benef respond -> RESPONSE_RECEIVED
  I istruttore close -> CLOSED, pratica torna UNDER_REVIEW
  AUTH internal senza secret -> 401

==NEXT (non in questo commit)==
- scheduler APScheduler cron 01:00 EXPIRED + cron 09:00 reminder
- upload amendment_document (istruttore) + response_document (benef) via files router
- template email locali non-PEC (reminder istruttore, notifica chiusura)
- UI istruttore: lista amendment + form crea/invia + proroga + reminder manuale
- UI benef: vista amendment + risposta con upload

app/schemas.py

@@ -5,6 +5,7 @@ from typing import Optional, Any, List
 from datetime import datetime, date
 from decimal import Decimal
 from uuid import UUID
+from enum import Enum
 from pydantic import BaseModel, Field
 
 
@@ -211,10 +212,36 @@ class GateCheckResult(BaseModel):
 
 # ====================== Istruttoria ======================
 
+# Stati formali amendment (speculare BE Gepafin ApplicationAmendmentRequestEnum, ridotti)
+class AmendmentStatus(str, Enum):
+    DRAFT = "DRAFT"                            # istruttore prepara, PEC non ancora partita
+    AWAITING = "AWAITING"                      # PEC inviata, attendo risposta benef
+    RESPONSE_RECEIVED = "RESPONSE_RECEIVED"    # benef ha risposto, istruttore deve valutare
+    EXPIRED = "EXPIRED"                        # deadline passata senza risposta (scheduler)
+    CLOSED = "CLOSED"                          # istruttore chiude dopo response o comunque
+
+
 class AmendmentRequestCreate(BaseModel):
     request_text: str
     deadline: date
     scope: Optional[dict] = None
+    response_days: Optional[int] = None        # pre-compilato default 15gg, variabile per istruttore
+    internal_note: Optional[str] = None        # visibile solo istruttore
+
+
+class AmendmentRequestUpdate(BaseModel):
+    """Modifica amendment solo in stato DRAFT."""
+    request_text: Optional[str] = None
+    deadline: Optional[date] = None
+    scope: Optional[dict] = None
+    response_days: Optional[int] = None
+    internal_note: Optional[str] = None
+
+
+class AmendmentExtend(BaseModel):
+    """Prolunga la deadline di un amendment AWAITING."""
+    extended_days: int = Field(..., gt=0, le=60)
+    motivation: Optional[str] = None
 
 
 class AmendmentResponseSubmit(BaseModel):
@@ -235,9 +262,63 @@ class AmendmentRequestOut(BaseModel):
     closed_by: Optional[int] = None
     created_at: datetime
 
+    # soccorso v3
+    response_days: Optional[int] = None
+    extended_days: Optional[int] = None
+    extension_date: Optional[datetime] = None
+    internal_note: Optional[str] = None
+    amendment_document_path: Optional[str] = None
+    amendment_document_type: Optional[str] = None
+    response_document_path: Optional[str] = None
+    response_document_type: Optional[str] = None
+    protocol_id: Optional[str] = None
+    pec_sent_at: Optional[datetime] = None
+    pec_failed_reason: Optional[str] = None
+
     model_config = {"from_attributes": True}
 
 
+# ===== schemas per endpoint interni chiamati dal BE Gepafin =====
+
+class AmendmentPendingPecOut(BaseModel):
+    """Lista amendment che il BE deve processare per invio PEC."""
+    id: UUID
+    practice_id: UUID
+    application_id: int
+    request_text: str
+    deadline: date
+    response_days: Optional[int] = None
+    amendment_document_path: Optional[str] = None
+    created_at: datetime
+
+
+class AmendmentPecDetail(BaseModel):
+    """Dettaglio richiesto dal BE per comporre PEC."""
+    id: UUID
+    practice_id: UUID
+    application_id: int
+    company_id: int
+    call_id: int
+    sequence_number: int
+    period_label: Optional[str] = None
+    request_text: str
+    deadline: date
+    response_days: Optional[int] = None
+    amendment_document_path: Optional[str] = None
+
+
+class MarkPecSent(BaseModel):
+    protocol_id: str
+    email_log_id: Optional[int] = None
+    user_action_id: Optional[int] = None
+    pec_sent_at: Optional[datetime] = None
+
+
+class MarkPecFailed(BaseModel):
+    reason: str
+    retry_after: Optional[datetime] = None
+
+
 class ReviewRejectBody(BaseModel):
     rejection_reason: str