fix(ssl): replace verify=True with ssl.create_default_context() for corporate CA support

Core fix: all httpx.AsyncClient instances now use ssl.create_default_context()
instead of bool verify=True, which uses certifi and ignores system CA store.
This makes corporate CA certificates installed via update-ca-certificates
visible to Python HTTP clients.

Files:
- async_network.py: AsyncAPIClient.__init__ converts True→SSLContext
- client_registry.py: get_client converts bool→SSLContext before passing
- notifications/providers.py: _get_http_client uses ssl.create_default_context()
- services/git/_base.py: GitServiceBase uses ssl.create_default_context()
- translate/_llm_async_http.py: _get_verify returns SSLContext (not string)

Test: new integration test with 3-tier PKI (Root→Intermediate→Server),
TLS-protected Superset container, and custom CA installation via
update-ca-certificates or SSL_CERT_DIR fallback.
- conftest.py: added ca_chain, install_custom_ca, superset_tls_env fixtures;
  parameterized superset_container for TLS mode
- test_superset_tls_custom_ca.py: 8 tests (openssl -CApath, -CAfile certifi,
  httpx capath, httpx certifi, AsyncAPIClient, SupersetClient, fingerprint, verify=False)

backend/src/services/git/_base.py

@@ -14,6 +14,7 @@ import os
 from pathlib import Path
 import re
 import shutil
+import ssl
 import threading
 from urllib.parse import quote
 
@@ -56,8 +57,11 @@ class GitServiceBase:
             self._closed = False
             self._close_lock = threading.Lock()
 
-            # Fix 5: Shared httpx.AsyncClient with connection pooling
+            # Fix 5: Shared httpx.AsyncClient with connection pooling.
+            # Uses system CA store (ssl.create_default_context) instead of certifi
+            # to trust corporate CA certificates installed via update-ca-certificates.
             self._http_client = httpx.AsyncClient(
+                verify=ssl.create_default_context(),
                 timeout=30.0,
                 limits=httpx.Limits(max_keepalive_connections=20, max_connections=100),
             )
@@ -397,5 +401,3 @@ class GitServiceBase:
     # endregion close
 # #endregion GitServiceBase
 # #endregion GitServiceBase
-# #endregion GitServiceBase
-# #endregion GitServiceBase

backend/src/services/notifications/providers.py

@@ -20,6 +20,7 @@
 from abc import ABC, abstractmethod
 from email.mime.multipart import MIMEMultipart
 from email.mime.text import MIMEText
+import ssl
 from typing import Any
 
 import aiosmtplib
@@ -32,10 +33,16 @@ _http_client: httpx.AsyncClient | None = None
 
 
 async def _get_http_client() -> httpx.AsyncClient:
-    """Get or create the module-level httpx.AsyncClient singleton."""
+    """Get or create the module-level httpx.AsyncClient singleton.
+    Uses system CA store (ssl.create_default_context) instead of certifi
+    to trust corporate CA certificates installed via update-ca-certificates.
+    """
     global _http_client
     if _http_client is None:
-        _http_client = httpx.AsyncClient(timeout=httpx.Timeout(30.0))
+        _http_client = httpx.AsyncClient(
+            verify=ssl.create_default_context(),
+            timeout=httpx.Timeout(30.0),
+        )
     return _http_client