feat(eims): add invoice mapper and signed EIMS transport

Map EDR invoices onto the MoR EIMS /v1/register document and add the
cryptographic transport needed to talk to core.mor.gov.et.

Mapper: DTOs mirror the supplied Postman collection section by section.
Tax is resolved per line via a caller-supplied resolver and throws when
unresolved -- the app models no tax at all (invoice.taxAmount is always 0,
invoice_lines and the rate catalogue carry no fiscal columns), so a
zero-rated default would assert a tax position the codebase cannot support.
Seller identity, document number, counters and previous IRN are passed in
explicitly; the mapper stays pure.

Transport: config, credential loading, RSA-SHA512 signing and /auth/login
with an in-memory token cache. Signing reproduces the process that produced
a working live token -- compact JSON of the inner request only, exact UTF-8
bytes, base64 signature, and base64 of the certificate file's exact bytes
with no parsing or re-encoding. Concurrent callers share one login via an
in-flight promise. Refresh is deliberately unimplemented: the collection
shows an unsigned refresh body but also ships unsigned examples of calls
that do require signing, so an expired token re-logs in instead.

Errors normalise to EimsApiException carrying only the gateway's own error
fields; secrets, signature, certificate and tokens never reach logs.
Key and certificate file patterns are gitignored.

Nothing calls EIMS automatically and no invoice entity, migration or UI is
touched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/edr-freight-api/src/config/eims.config.ts

@@ -0,0 +1,80 @@
+import { registerAs } from "@nestjs/config";
+
+/**
+ * Ethiopian MoR EIMS e-invoicing gateway.
+ *
+ * Disabled by default: with `EIMS_ENABLED=false` the config resolves to a stub and every EIMS
+ * service throws a clear error on use, so a deployment without credentials still boots.
+ *
+ * Secrets (client secret, API key) and the credential file paths live only here and are never
+ * logged — validation reports missing variable *names*, never their values.
+ */
+export interface EimsConfig {
+  enabled: boolean;
+  baseUrl: string;
+  clientId: string;
+  clientSecret: string;
+  apiKey: string;
+  tin: string;
+  /** MoR-issued source-system identifiers; unused until invoice registration lands. */
+  systemNumber: string;
+  systemType: string;
+  /** Filesystem path to the INSA-issued RSA private key (PEM). Never leaves the server. */
+  privateKeyPath: string;
+  /** Filesystem path to the INSA-issued certificate bundle; sent as base64 of its exact bytes. */
+  certificatePath: string;
+  httpTimeoutMs: number;
+  /** Re-authenticate this many ms before the access token actually expires. */
+  tokenSkewMs: number;
+}
+
+const REQUIRED_VARS = [
+  "EIMS_CLIENT_ID",
+  "EIMS_CLIENT_SECRET",
+  "EIMS_API_KEY",
+  "EIMS_TIN",
+  "EIMS_PRIVATE_KEY_PATH",
+  "EIMS_CERTIFICATE_PATH",
+] as const;
+
+const positiveInt = (raw: string | undefined, fallback: number, name: string): number => {
+  if (raw === undefined || raw === "") return fallback;
+  const value = Number.parseInt(raw, 10);
+  if (Number.isNaN(value) || value <= 0) {
+    throw new Error(`${name} must be a positive integer`);
+  }
+  return value;
+};
+
+export default registerAs("eims", (): EimsConfig => {
+  const enabled = (process.env.EIMS_ENABLED ?? "false").toLowerCase() === "true";
+  const baseUrl = (process.env.EIMS_BASE_URL ?? "https://core.mor.gov.et").replace(/\/+$/, "");
+  const httpTimeoutMs = positiveInt(process.env.EIMS_HTTP_TIMEOUT_MS, 30_000, "EIMS_HTTP_TIMEOUT_MS");
+  const tokenSkewMs =
+    positiveInt(process.env.EIMS_TOKEN_SKEW_SECONDS, 45, "EIMS_TOKEN_SKEW_SECONDS") * 1000;
+
+  const base: EimsConfig = {
+    enabled,
+    baseUrl,
+    clientId: process.env.EIMS_CLIENT_ID ?? "",
+    clientSecret: process.env.EIMS_CLIENT_SECRET ?? "",
+    apiKey: process.env.EIMS_API_KEY ?? "",
+    tin: process.env.EIMS_TIN ?? "",
+    systemNumber: process.env.EIMS_SYSTEM_NUMBER ?? "",
+    systemType: process.env.EIMS_SYSTEM_TYPE ?? "",
+    privateKeyPath: process.env.EIMS_PRIVATE_KEY_PATH ?? "",
+    certificatePath: process.env.EIMS_CERTIFICATE_PATH ?? "",
+    httpTimeoutMs,
+    tokenSkewMs,
+  };
+
+  if (!enabled) return base;
+
+  const missing = REQUIRED_VARS.filter((name) => !process.env[name]);
+  if (missing.length > 0) {
+    throw new Error(
+      `EIMS integration is enabled (EIMS_ENABLED=true) but the following env vars are missing: ${missing.join(", ")}`,
+    );
+  }
+  return base;
+});