feat: auto-issue PDF completion certificates on course finish

[harshkumar9973]

• New certificates module (model, repo, service, controller, CASL abilities)
• Idempotent issuance hooked into ProgressService on 100% completion
• Public verification endpoint + authed 'my certificates' endpoint
• Frontend: react-pdf certificate template + download button wired into the student dashboard's completed-courses view
• 4 passing integration tests (issuance, verification, 404, idempotency)

[MeenakshiArunsankar]

@harshkumar9973 please create a short demo video and share the link here. Add basic technical details of implementation also here.

[harshkumar9973]

@harshkumar9973 please create a short demo video and share the link here. Add basic technical details of implementation also here.

@MeenakshiArunsankar
Demo Video: https://drive.google.com/file/d/1xn867bEqnaj3lhsfVR51fIVW-vJl9B9M/view?usp=drivesdk

(Opens with a note on why this is API-driven rather than a UI walkthrough: a pre-existing, unrelated gap in the frontend blocks local sign-in — it never wires up Firebase's Auth emulator, though the backend expects it.)

Technical details:

Built a certificates module that auto-issues verifiable PDF completion certificates when a student's progress hits 100%.

Backend: new self-contained module (Mongo repository, service, controller, CASL abilities) following the existing modular DI pattern, hooked into ProgressService via a fire-and-forget, idempotent call — so it never blocks the progress update path and never issues duplicates. Two endpoints: a public verification route keyed by a random UUID (not the Mongo _id, so it doesn't leak internal identifiers), and an authenticated "my certificates" route.

Frontend: react-pdf certificate template + download button, wired into the student dashboard's completed-courses view.

Covered by 4 integration tests (issuance, verification, 404 handling, idempotency) — all passing, shown in the demo video via live calls against the actual running server.