fix: harden Psalm with server-aware context and related signing fixes

[vitormattos]

📝 Summary

This PR hardens LibreSign's Psalm setup while cleaning up the related code paths that surfaced during the tightening work.

• extracts ActiveSigningsService from AdminController and adds focused unit coverage
• restores Files app event wiring for sidebar/additional script integration
• normalizes CRL serial handling so decimal and hexadecimal serial inputs are rendered correctly in generated CRLs
• aligns Psalm with the real nextcloud/server type context, including server-owned OCA/*, sabre/*, and doctrine/dbal dependencies
• updates the Psalm CI and baseline workflows to run inside a nextcloud/server checkout instead of duplicating server 3rdparty packages in LibreSign
• simplifies the twofactor_gateway integration by delegating to the upstream GatewayDirectIntegrationService
• keeps the Psalm baseline empty while ratcheting high-signal issue families to error

🔜 Follow-up

A full exploratory Psalm run with errorLevel="1" still reports real code issues, so this PR intentionally stops at infrastructure and targeted ratcheting instead of lowering the global level in one jump.

The next focused cleanup should target the issue families that showed up most often:

• Mixed*
• ClassMustBeFinal
• RiskyTruthyFalsyComparison
• nullability issues such as PossiblyNullReference and PossiblyNullArgument

Once those families are reduced in focused follow-up PRs, we can safely revisit lowering the global Psalm error level.

[vitormattos]

/backport to stable34

[vitormattos]

/backport to stable33

[vitormattos]

/backport to stable32