bf4464ba37
H1+H2: Field technicians had perm_create=1 perm_write=1 on inspection certs (could forge or edit issued certs). Reduced to read-only - the visit-report wizard already sudos when creating new certs from a tech visit. Added rule_inspection_cert_readonly for the dispatcher group so even dispatchers cannot edit already-issued certs; only the manager can revoke/correct. Sealed audit trail. H3: Replaced display:flex / gap (which wkhtmltopdf 0.12 renders as a vertical stack) with inline-block + margin in the certificate PDF. Footer uses float left/right for the cert-number / inspector signature line so the layout survives wkhtmltopdf rendering. Bumped to 19.0.1.4.1. Co-authored-by: Cursor <cursoragent@cursor.com>