fix: use OS trust store for TLS verification via truststore

Regression from #62: verify_ssl true used to resolve to the system CA
bundle path, so corporate CAs installed in the OS worked; after the
unification true became requests' default (certifi), breaking setups
with a corporate CA in the system store.

Now verify_ssl true injects truststore, so requests verifies against
the OS trust store on any platform. verify_ssl false / custom CA path
behavior is unchanged. Tests mock truststore via an autouse fixture to
keep the pytest process free of global ssl mutation.

Refs #62

redmine_reporter/client.py

@@ -3,6 +3,7 @@ from datetime import datetime, timezone
 from typing import Any, Dict, List, Optional, Tuple, Union
 
 import requests
+import truststore
 from redminelib import Redmine
 from redminelib.exceptions import AuthError, ForbiddenError, ResourceNotFoundError
 from redminelib.resources import Issue
@@ -49,12 +50,21 @@ def _make_retry_adapter() -> requests.adapters.HTTPAdapter:
 
 
 def _create_redmine() -> Redmine:
-    """Создаёт Redmine-клиент с таймаутом и retry-адаптером (#24)."""
+    """Создаёт Redmine-клиент с таймаутом и retry-адаптером (#24).
+
+    При verify=True подключает системное хранилище CA ОС через
+    truststore.inject_into_ssl() (#62).
+    """
+    verify = Config.get_redmine_verify()
+    if verify is True:
+        # verify_ssl: true — проверка по системному хранилищу CA ОС (truststore),
+        # а не по certifi: корпоративные CA из ОС продолжают работать (#62).
+        truststore.inject_into_ssl()
     redmine = Redmine(
         Config.get_redmine_url(),
         **_get_redmine_auth_kwargs(),
         requests={
-            "verify": Config.get_redmine_verify(),
+            "verify": verify,
             "timeout": REQUEST_TIMEOUT,
         },
     )