support BTUOrderParams for EBICS 3.0 request

…ents

…te-params

feat(certificate): make key length and validity years configurable

feat(cli): add parameterized launcher for runtime-configured environments

Bumps [org.bouncycastle:bcprov-jdk18on](https://github.com/bcgit/bc-java) from 1.82 to 1.84.
- [Changelog](https://github.com/bcgit/bc-java/blob/main/docs/releasenotes.html)
- [Commits](https://github.com/bcgit/bc-java/commits)

---
updated-dependencies:
- dependency-name: org.bouncycastle:bcprov-jdk18on
  dependency-version: '1.84'
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>

The letters printed the SHA-256 of the public key by default, but the
INI/HIA requests always transmit the X.509 certificate. Under H005 the
letter must carry the SHA-256 of the DER-encoded certificate (spec
4.4.1.2.3), which the bank verifies against the request — the public-key
hash failed bank-side verification

fixes #49

…tle-bcprov-jdk18on-1.84

Bump org.bouncycastle:bcprov-jdk18on from 1.82 to 1.84

…rypto

Java 17 ships java.util.Base64 (since 8) and java.util.HexFormat (since 17),
so commons-codec is redundant. gnu-crypto was declared in pom.xml but never
imported.

…range

Downloads sent the 3-letter order code as AdminOrderType with empty
StandardOrderParams, which EBICS 3.0 banks reject for customer data. This
mirrors the existing BTU upload path: optional EbicsDownloadParams produce
AdminOrderType=BTD with a BTDOrderParams/Service block, container type and an
optional DateRange.

Also fixes the date range that fetchFile(file, orderType, start, end) accepted
and dropped: without a service name the legacy order type is kept and the range
goes into StandardOrderParams. Behaviour without params is unchanged.

Dates are written as plain xs:date; passing a Calendar made XMLBeans append the
local offset (2026-08-10+02:00), which shifts the reported day for a bank in
another timezone.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

…ocalDate

Review round 1 on the BTD download support.

- Reject a partial or reversed date range in the EbicsDownloadParams constructor,
  the one place every caller passes through. A half range used to be dropped when
  the request was built, on the launcher's legacy path without even a warning; a
  reversed range is schema-valid and comes back as EBICS_NO_DOWNLOAD_DATA_AVAILABLE,
  indistinguishable from a genuinely empty period.
- Check every launcher argument before the first environment read, keystore access
  or bank call. It ran after loadUser/createUser and after --ini/--hia/--hpb, so an
  incomplete --btd order could still fire an INI request first, and INI is one-shot
  at most banks.
- Carry the report period as LocalDate instead of Date. A calendar day read out of
  an instant depends on the machine's timezone: a UTC-midnight Date becomes the
  previous day west of UTC. The Date-taking overloads are kept and now document
  that. Adds createDateRange(LocalDate, LocalDate).
- Upper-case the EBICS code list values (--service, --scope, --option, --container)
  so --container zip no longer aborts. Message names such as camt.053 stay as given.

Tests 31 -> 36. New guards were each seen failing first.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

feat(h005): support BTD download orders with service params and date range

- add fetchFile with defaultUser

refactor: replace Apache HttpClient with JDK java.net.http.HttpClient