feat(notifications): cert authority events + QM activity (Tasks 17-20)

TRIGGER_EVENTS extended with three new events:
  - cert_awaiting_issuance — fires on in_progress → awaiting_cert
  - cert_voided_re_notify  — fires on awaiting_ship → awaiting_cert
                             regress (cert voided post-issue)
  - job_shipped            — fires on button_mark_shipped

_dispatch routes cert events through new internal-recipient resolver
(QM/Manager/Owner via all_group_ids, transitive per Rule 13l)
instead of the partner-based stream lookup. Other events unchanged.

Mail templates (fp_cert_authority_templates.xml): two new
mail.template records bound to fp.job. Amber accent bar for awaiting,
red accent bar for void-re-issue. Deep-link to
/odoo/action-...?tab=certificates so QM lands on the right tab.

Activity type (fp_activity_types_data.xml): mail.activity.type
activity_type_issue_coc — bound to fp.job, 1-day delay, certificate
icon.

fp.job helpers:
  _fp_schedule_cert_activity: round-robin by oldest login_date,
    idempotent on existing open activity, soft-fails if helpers
    are missing.
  _fp_resolve_cert_activities: auto-resolves on awaiting_ship,
    soft-fails on per-activity exceptions.

Manifest bumps:
  fusion_plating_notifications 19.0.6.6.1 → 19.0.7.0.0
  fusion_plating_jobs: data list gains fp_activity_types_data.xml

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

fusion_plating/fusion_plating_notifications/models/fp_notification_template.py

@@ -24,6 +24,10 @@ TRIGGER_EVENTS = [
     ('rma_authorised', 'RMA Authorised'),     # Sub 12 — RMA lifecycle
     ('rma_received', 'RMA Parts Received'),
     ('rma_resolved', 'RMA Resolved'),
+    # Spec 2026-05-25 — post-shop cert + shipping states
+    ('cert_awaiting_issuance', 'Cert Awaiting Issuance'),
+    ('cert_voided_re_notify',  'Cert Voided — Please Re-Issue'),
+    ('job_shipped',            'Job Shipped (manual mark)'),
 ]
 
 # Sub 6 — map each trigger event to a communication stream. Contacts on
@@ -119,9 +123,17 @@ class FpNotificationTemplate(models.Model):
         if attachment_ids:
             attachment_names = self.env['ir.attachment'].browse(attachment_ids).mapped('name')
 
-        # Sub 6 — resolve recipients via the contact-routing helper.
+        # Spec 2026-05-25 — cert authority events go to INTERNAL users
+        # (Manager / QM / Owner), not customer contacts. Replace partner-
+        # based resolution with the group-membership resolver.
         recipient_emails = []
-        if partner:
+        if trigger_event in ('cert_awaiting_issuance',
+                             'cert_voided_re_notify'):
+            authority_users = self._fp_resolve_cert_authority_users(record)
+            recipient_emails = [
+                u.email for u in authority_users if u.email
+            ]
+        elif partner:
             stream = FP_TRIGGER_STREAM.get(trigger_event)
             if stream:
                 recipient_emails = partner._fp_resolve_notification_recipients(
@@ -173,6 +185,33 @@ class FpNotificationTemplate(models.Model):
                 'error_message': str(exc),
             })
 
+    @api.model
+    def _fp_resolve_cert_authority_users(self, source_record=None):
+        """Return active, non-share users holding QM | Manager | Owner
+        (transitive via all_group_ids). Per CLAUDE.md Rule 13l, direct
+        user_ids on a group record only catches DIRECT memberships;
+        Owners reach QM authority via the implication chain and would
+        be missed by a naive .user_ids walk.
+
+        Spec 2026-05-25 §Notification recipient resolution.
+        """
+        gids = []
+        for xmlid in (
+            'fusion_plating.group_fp_quality_manager',
+            'fusion_plating.group_fp_manager',
+            'fusion_plating.group_fp_owner',
+        ):
+            grp = self.env.ref(xmlid, raise_if_not_found=False)
+            if grp:
+                gids.append(grp.id)
+        if not gids:
+            return self.env['res.users']
+        return self.env['res.users'].sudo().search([
+            ('all_group_ids', 'in', gids),
+            ('share', '=', False),
+            ('active', '=', True),
+        ])
+
     def _collect_attachments(self, record):
         """Return a list of ir.attachment ids to attach to the email based
         on the template's attach_* flags and the record's context.