feat(config): add EnvironmentConfig and CertConfig DTOs; refactor NfseClient constructor

[vitormattos]

Summary

Completes Phase 1 of the nfse-php package-core plan by adding the missing config contracts: environment and certificate DTOs.

Changes

New: src/Config/EnvironmentConfig.php

Immutable DTO encapsulating sandbox/production mode and the derived base URL.

• Defaults to production URL when sandboxMode=false
• Selects sandbox URL when sandboxMode=true
• Accepts an explicit baseUrl override (for tests and custom deployments)

New: src/Config/CertConfig.php

Immutable DTO for mTLS certificate configuration.

• cnpj — 14-digit contributor CNPJ matching the ICP-Brasil certificate subject
• pfxPath — absolute filesystem path to the PFX bundle
• vaultPath — OpenBao KV path for just-in-time password retrieval

Refactored: src/Http/NfseClient.php

Constructor now accepts EnvironmentConfig and CertConfig instead of raw primitives (sandboxMode: bool, baseUrlOverride: ?string).

• Removes BASE_URL_PROD / BASE_URL_SANDBOX constants (now in EnvironmentConfig)
• All URL derivation logic centralized in EnvironmentConfig

Tests

• tests/Unit/Config/EnvironmentConfigTest.php — 4 new tests for URL resolution logic
• tests/Unit/Config/CertConfigTest.php — 4 new tests for property storage and readonly enforcement
• tests/Unit/Http/NfseClientTest.php — updated to use makeClient() helper with new DTOs

Test count: 19 → 27 unit tests

Gates

• phpunit: 27/27 ✓
• cs:fix: 0 files changed ✓
• psalm: No errors found ✓