Complete the generic SEFIN event query and registration API #50

Parent epic: #47

Context

The official API exposes a generic event model, including:

• POST /nfse/{chaveAcesso}/eventos
• GET /nfse/{chaveAcesso}/eventos
• GET filtered by event type/sequence

The library currently has cancellation convenience and a single typed event lookup, while ADN also exposes distributed events.

Goal

Expose the complete generic SEFIN event surface while keeping cancellation as a convenience wrapper.

Scope

• list all SEFIN events for an access key
• filter/query event type and sequence
• introduce a generic signed event registration primitive with typed result/error
• refactor cancellation to use the generic primitive without behavior change
• keep ADN-distributed-event APIs separate from SEFIN event APIs

Constraints

• event-specific XML builders must be explicit; do not accept arbitrary unsigned XML as trusted input
• no Akaunting dependencies
• preserve raw upstream payload/XML for diagnostics without leaking certificate secrets

Tests

• list all events
• filter by type/sequence
• register an event with signed XML
• HTTP/rejection/malformed payload cases
• cancellation regression through the generic path

Definition of done

• endpoint matrix documented
• method names distinguish SEFIN from ADN
• XSD tests cover registered event XML
• cancellation behavior remains compatible

Contract discrepancy found during implementation

The current contributor manual documents:

• GET /nfse/{chaveAcesso}/eventos
• GET /nfse/{chaveAcesso}/eventos/{tipoEvento}
• GET /nfse/{chaveAcesso}/eventos/{tipoEvento}/{numSeqEvento}

However, the production Swagger snapshot reviewed during implementation explicitly defines only the GET endpoint with tipoEvento/numSeqEvento (plus POST on the base path), using EventosPostResponseSucesso as the response shape.

Do not add the base/type-only GET calls blindly. Before implementing them, verify the live/current official Swagger or another authoritative executable contract. If the manual and Swagger remain inconsistent, preserve the discrepancy in documentation and keep only the verified endpoint enabled by default.

This issue may be split into:

1. verified generic registration/query primitives backed by executable contracts;
2. optional list/filter GET methods once current production support is proven.