Third-party verifiable certificates, batch revocation, and a review queue

Added

• A readable verification address printed on the certificate: obscuraflow.app/c/<number>/<version>, both in plain text and in the QR code. A buyer without the software now lands on a page rather than a link only the app can open. The obscura: scheme is still printed alongside — it alone works offline.
• The signed bytes now travel inside the PDF. The document carried the manifest, its digest, and the signature, but not the exact projection the signature covers: an outside verifier had to rebuild it, and a single byte of drift would show “invalid signature” on a genuine certificate. It is now carried as-is. The app still recomputes it — that is precisely what catches a drift.
• Batch revocation for a compromised key. A stolen key meant revoking certificates one at a time, by hand, at the moment you have the least time to click. The key is now marked compromised first, then all of its valid certificates are revoked in one operation, with a summary (revoked, already revoked, queued, never published). Earlier revocations are never overwritten.
• A closed vocabulary of revocation reasons: object lost, issued in error, attribution rejected, forgery, key compromised, legal withdrawal. The registry is public — until now a buyer read a free-form sentence, in the issuer’s language. The reason now travels as a normalised value, translated at display time, with an optional detail alongside. A typo on a document is not grounds for revocation: that is a reissue.
• Review queue: a disputed attribution and a rejected attribution do not call for the same follow-up. The first makes the document inaccurate (reissue), the second removes the basis it rested on (revocation). Each flagged certificate ends in a decision — keep, reissue, revoke — and nothing is ever revoked automatically.
• A Catalogue tab in Settings: artwork numbering format (SB-2026-000154), publication threshold, and default confidentiality. The numbering block locks as soon as an artwork carries a number, and says so — instead of letting you find out afterwards. Artwork numbering is now independent of certificate numbering: the two identify different things.

Fixed

• A portrait photo is no longer described as landscape. Displayed dimensions followed the frame written by the sensor, before orientation, so the figure contradicted the thumbnail next to it. The inspector, the VoiceOver label, and integrity reports now use dimensions as displayed. Existing libraries are migrated automatically.
• Deterministic RAW dimensions. The same DNG could enter the catalogue as 8272 × 6200 and then, on the next launch, as 8280 × 192: tags a file exposes more than once were resolved in an unspecified order, sometimes from two different previews. Resolution now follows an explicit precedence.
• The search fields in Exhibitions and Publications displayed action.search instead of a label.
• An empty archive is no longer silently accepted.