- CertificateVerifyView: GET /certificates/verify/{serial}/ — AllowAny
- Re-computes SHA-256 from stored PDF and compares to archived hash
- Returns {valid, serial_number, course_title, issued_at, hash} — no PII
- Returns 404 for non-completed or non-existent certificates
- 7 integration tests: hash match, tampered hash, missing file, PII exclusion, 404 cases
Co-Authored-By: Paperclip <noreply@paperclip.ing>