feat(qualification): 资质库和资质匹配（查标第 4 步，规则集 2026.11-r4）

- 资质库（FR-M6-08）：增删改、证书扫描件（PDF/JPG/PNG，企业级密钥加密、签名下载）、
  late_for 按进行中项目的投标截止日提醒、审计；前端资质库页和对话框，侧栏入口
- 资质匹配（FR-M3-05）：证书类别词表（16 类，产品证书、人员证书不进匹配），
  QUAL.EXPIRED / LEVEL_LOW / NOT_COVERED；投标文字层按清单项定级，只有资质库记录的降一级，
  出处显示「依据：资质库记录」（查标页、报告模板 v2）；一类证书一个问题；评分项不逐条找响应的也查
- 响应错位规则不再把资质表的证书名称格当成照抄的要求
- 评测：qual_defects.py 派生资质情况表，D12 3/3、D18 2/2、规矩的资质表 0 误报；开发集不退化
- 决策 QL1–QL7；方案和落地记录 docs/architecture/qualification-plan.md，评测 check-eval.md §13

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/pyproject.toml

@@ -83,11 +83,11 @@ type = "forbidden"
 source_modules = ["bid_doctor.core"]
 forbidden_modules = ["bid_doctor.identity", "bid_doctor.billing", "bid_doctor.project", "bid_doctor.document",
                      "bid_doctor.checklist", "bid_doctor.check", "bid_doctor.ai", "bid_doctor.audit",
-                     "bid_doctor.notification", "bid_doctor.ops"]
+                     "bid_doctor.notification", "bid_doctor.ops", "bid_doctor.qualification"]
 
 [[tool.importlinter.contracts]]
 name = "业务模块不依赖 api 层的组合模块"
 type = "forbidden"
 source_modules = ["bid_doctor.document", "bid_doctor.checklist", "bid_doctor.check", "bid_doctor.billing",
-                  "bid_doctor.identity.service", "bid_doctor.ops"]
+                  "bid_doctor.identity.service", "bid_doctor.ops", "bid_doctor.qualification"]
 forbidden_modules = ["bid_doctor.project.workbench", "bid_doctor.app"]