feat(qualification): 资质库和资质匹配（查标第 4 步，规则集 2026.11-r4）

- 资质库（FR-M6-08）：增删改、证书扫描件（PDF/JPG/PNG，企业级密钥加密、签名下载）、
  late_for 按进行中项目的投标截止日提醒、审计；前端资质库页和对话框，侧栏入口
- 资质匹配（FR-M3-05）：证书类别词表（16 类，产品证书、人员证书不进匹配），
  QUAL.EXPIRED / LEVEL_LOW / NOT_COVERED；投标文字层按清单项定级，只有资质库记录的降一级，
  出处显示「依据：资质库记录」（查标页、报告模板 v2）；一类证书一个问题；评分项不逐条找响应的也查
- 响应错位规则不再把资质表的证书名称格当成照抄的要求
- 评测：qual_defects.py 派生资质情况表，D12 3/3、D18 2/2、规矩的资质表 0 误报；开发集不退化
- 决策 QL1–QL7；方案和落地记录 docs/architecture/qualification-plan.md，评测 check-eval.md §13

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/tests/test_report_flow.py

@@ -138,3 +138,21 @@ async def test_project_submit_archive_and_undo(user: User) -> None:
     assert r.json()["status"] == "submitted"  # 回到归档前
     r = await user.post(f"/projects/{project_id}/transitions", json={"action": "unsubmit"})
     assert r.json()["status"] == "checked"
+
+
+def test_template_shows_library_basis_for_qualification_findings() -> None:
+    """只按资质库记录判断的资质问题，问题明细里写出依据的那条记录（QL2）。"""
+    f = {
+        "type": "qualification",
+        "detail": {
+            "issues": [
+                {
+                    "source": "library",
+                    "library": {"name": "安全生产许可证", "cert_no": "X-1", "valid_to": "2026-10-31"},
+                },
+                {"source": "bid_text"},
+            ]
+        },
+    }
+    assert template._library(f) == ["<div>依据：资质库记录《安全生产许可证》 · 编号 X-1 · 有效期至 2026-10-31</div>"]  # pyright: ignore[reportPrivateUsage]
+    assert template._library({"type": "unresponded", "detail": {}}) == []  # pyright: ignore[reportPrivateUsage]