Deliver F18 documents and certificates (DEC50): versioned templates, two-person signatures, public verification

- document_templates / document_template_versions / document_signatories /
  document_certificates / document_versions; references globally unique so the
  public lookup needs no tenant
- DocumentService owns every write (issue, sign, revoke, reissue, template
  amend/retire, signatory register/retire) with tenant assertions, door checks
  and audit rows; Code39 gives the printed reference a dependency-free barcode
- the issuer can never sign their own issuance, and only an active registered
  signatory holding document_certificates.sign may sign; a retired signatory
  can neither sign nor be re-added
- public /verify discloses five facts only (reference, type, issue date,
  status, clinic name); revoked references stay revoked forever and unknown
  references answer a branded page with HTTP 404
- reissue creates a new reference linked by supersedes_certificate_id; every
  template amendment appends an immutable version and an issued certificate
  snapshots the version and rendered body it was issued from
- letterheaded print-to-PDF sheet (DEC45 precedent, no PDF library); doors
  129 -> 135, module documents.certificates delivered on every site bundle
- evidence: DocumentCertificateTest (16 tests / 277 assertions),
  scripts/walk-f18.php (14 live steps), 24 gated screenshots, a 39-combination
  narrow/tablet/desktop audit and Lighthouse runs under
  outputs/feature-evidence/F18-document-certificates/rev-20261027-001/
- fixed while evidencing it: page-level horizontal scroll on narrow screens
  (an absolutely positioned .sr-only label escaped the table's scroll box) and
  a 2.13:1 print-sheet contrast from the dark theme's muted grey
- carries the owed O11 repairs: three migration typos and four wrong
  assertions in PublicWebsiteTest, and the shared catalogue pins 129 -> 135
  in InventoryCoreTest, QualityIncidentTest and TrainingProgramTest
