docs(infakt): ADR Infakt-KSeF indirection model + operator setup guide

[norbert-kulus-blockydevs]

Part of #1279
Depends on #1281 (for accurate webhook endpoint docs)

Context

The Infakt integration uses an unusual KSeF model: Infakt mediates KSeF on behalf of OL. This is architecturally distinct from direct KSeF (where OL owns the crypto session) and from Subiekt (where a local bridge auto-submits). The decision deserves an ADR.

Scope

1. ADR: Infakt-as-KSeF-intermediary

File: docs/architecture/adrs/0NN-infakt-ksef-indirection.md (next free number — check docs/architecture/adrs/ for current tail)

Key decisions to capture:

• OL implements RegulatoryStatusReader (NOT RegulatoryTransmitter) for Infakt
• Rationale: Infakt auto-submits to KSeF when invoice is created; OL cannot control the submit timing or session
• Consequence: submitForClearance() is not exposed on InfaktInvoicingAdapter
• Status polling: OL reads invoice.ksef_data.ksef_status via GET /invoices/{uuid}.json
• Webhook as push-notification shortcut: send_to_ksef_success / send_to_ksef_error trigger immediate status refresh

Alternatives considered:

• Direct KSeF session from OL (like @openlinker/integrations-ksef) — rejected: requires NIP-authenticated token + certificate management; Infakt already handles this
• Disabling KSeF auto-submit in Infakt settings — viable fallback but webhook is preferred

2. Operator setup guide

File: docs/integrations/infakt/setup-guide.md

Sections:

1. Prerequisites (Infakt account, KSeF enabled in Infakt settings, API key generation)
2. Creating the connection in OL (API key entry, optional sandbox baseUrl)
3. Webhook configuration (manual in Infakt dashboard — OL URL: POST /webhooks/infakt/{connectionId}, HMAC secret)
4. Verifying the integration (create test invoice via OL, check KSeF status)
5. Troubleshooting (signature mismatch, ksef_status: error codes, rate limits)

3. Update docs/architecture-overview.md

In Section 14 (Invoicing), add Infakt alongside KSeF and Subiekt:

Second provider: inFakt (Polish accounting SaaS), @openlinker/integrations-infakt, adapterKey infakt.accounting.v1, registry capability Invoicing. Acts as a KSeF intermediary: invoice creation auto-triggers KSeF submission by Infakt; OL reads clearance status via GET /invoices/{uuid} and receives push notifications via webhooks. Implements RegulatoryStatusReader and CorrectionIssuer sub-capabilities.

4. Update ADR index

Add row to docs/architecture/adrs/README.md.

Acceptance criteria

• ADR follows template in docs/architecture/adrs/README.md
• ADR status: Accepted
• Setup guide covers the webhook URL and HMAC secret configuration steps
• docs/architecture-overview.md updated with Infakt provider entry

[norbert-kulus-blockydevs]

To verify — possible gap: PR #1307's docs flag a possible gap around the webhook-secret exchange direction between OL and inFakt's dashboard, not yet confirmed live. The setup guide documents the likely flow (generate in OL via Rotate webhook secret, paste into inFakt) plus a fallback note for the reverse case, and calls out that OL currently has no endpoint to set the webhook secret to an arbitrary caller-supplied value — only to rotate to a new random one. Needs live verification against inFakt's actual webhook-subscription UI to confirm whether this is a real gap.