[vitormattos]

Problem

The shared local NFS-e development installation now runs Akaunting Core 3.2.4. During homologation, we found three reproducibility and correctness gaps:

• The Core's API exception handler mapped AuthenticationException to HTTP 500 instead of 401, obscuring failed authentication and cross-company access denial.
• The required HTML editor adjustment existed only as a local uncommitted change.
• The automatically loaded historical patch disabled API request throttling. Recovery material had also been stored outside the development project's directory.

Changes

• Add a Core 3.2.4-specific patch mapping AuthenticationException to HTTP 401 without changing NFS-e business logic.
• Preserve the reviewed HTML editor adjustment as a separate Core 3.2.4 patch.
• Move the historical throttle-bypass patch to patches/legacy/, outside the runtime's top-level patches/*.patch auto-application path. Keep it for audit, not for activation.
• Add scripts/apply-core-patches.sh, which verifies the expected Core tag, skips patches already applied, and stops on conflicts rather than overwriting source changes.
• Add scripts/verify-local.sh for non-destructive environment, migration, and HTTP checks.
• Update the integration workflow to verify the two patches and confirm that throttle:api remains enabled.
• Document the validated local versions, recovery precautions, company isolation, and safe test workflow. Keep local backups and evidence under the Git-ignored .local-state/ directory inside akaunting-docker.

Verification

Local checks completed:

• Both patches applied cleanly to pristine Core 3.2.4 source files and matched the active installation; the existing container patch loader also recognized already-applied patches.
• Exception handling returned 401 for AuthenticationException, 403 for access denial, and 404 for missing routes.
• Real browser login and NFS-e read-only screens returned 200; native Basic Auth API GETs returned 200 for an authorized company and 401 for a company without access. A synthetic test user was removed afterward.
• The standalone NFS-e PHPUnit suite reported 1,124 tests, 5,257 assertions, 0 failures, and 5 skipped (Eloquent-dependent tests in that standalone runner).
• Docker Compose validation and shell syntax checks passed.

These are local homologation results, not a statement that all GitHub Actions checks have passed. The browser scenario also used the Nginx Host-port correction proposed in #55, which is a separate change.

Boundaries and follow-up

• Patches are deliberately restricted to Core 3.2.4. Any future Core upgrade must revalidate them rather than applying them blindly.
• The second company's persistent onboarding remains incomplete; the positive read-only scenario was checked only with temporary state reverted at the end.
• This PR does not implement the NFS-e API architecture, complete fiscal issuance testing, or change persistent business data.
• No production changes, real fiscal emissions, destructive database operations, or secret/backup uploads were performed.

Related: #55 covers the independent Nginx Host-header and static-source restrictions.