docs: rebrand Certifai -> Prüfwerk (user-facing name)

The product is renamed Certifai -> Prüfwerk. This changes only the user-facing
brand text in the documentation (docs/**, VitePress title/name). It does NOT
touch functional identifiers that happen to contain "certifai" (the Docker
network, Keycloak realm/client, Harbor image project, the compliance-* crate
names, or the repo name) — those are infra-coupled and need a separate,
coordinated migration.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv

docs/reference/glossary.md

@@ -1,11 +1,11 @@
 # Glossary
 
-A reference of key terms used throughout Certifai.
+A reference of key terms used throughout Prüfwerk.
 
 ## Security Terms
 
 **SAST (Static Application Security Testing)**
-Analysis of source code to find vulnerabilities without running the application. Certifai uses Semgrep for SAST scanning.
+Analysis of source code to find vulnerabilities without running the application. Prüfwerk uses Semgrep for SAST scanning.
 
 **DAST (Dynamic Application Security Testing)**
 Testing a running application by sending crafted requests and analyzing responses. Finds vulnerabilities that only appear at runtime.
@@ -45,26 +45,26 @@ A license that allows broad freedom to use, modify, and distribute software with
 ## Standards and Formats
 
 **CycloneDX**
-An OWASP standard for SBOM formats. Certifai supports export in CycloneDX 1.5 JSON format.
+An OWASP standard for SBOM formats. Prüfwerk supports export in CycloneDX 1.5 JSON format.
 
 **SPDX (Software Package Data Exchange)**
-A Linux Foundation standard for communicating software bill of materials information. Certifai supports export in SPDX 2.3 format.
+A Linux Foundation standard for communicating software bill of materials information. Prüfwerk supports export in SPDX 2.3 format.
 
 ## Tools
 
 **Semgrep**
-An open-source static analysis tool that finds bugs and enforces code standards using pattern-matching rules. Used by Certifai for SAST scanning.
+An open-source static analysis tool that finds bugs and enforces code standards using pattern-matching rules. Used by Prüfwerk for SAST scanning.
 
 **Syft**
-An open-source tool for generating SBOMs from container images and filesystems. Used by Certifai to extract dependency information.
+An open-source tool for generating SBOMs from container images and filesystems. Used by Prüfwerk to extract dependency information.
 
 **OSV.dev**
-Google's open distributed vulnerability database, queried by package URL. Certifai uses it (together with NVD) to match SBOM components against known vulnerabilities.
+Google's open distributed vulnerability database, queried by package URL. Prüfwerk uses it (together with NVD) to match SBOM components against known vulnerabilities.
 
 ## Protocols
 
 **MCP (Model Context Protocol)**
-An open standard that allows LLM-powered tools to connect to external data sources and call tools. Certifai exposes security data through MCP so AI assistants can query findings, SBOMs, and DAST results.
+An open standard that allows LLM-powered tools to connect to external data sources and call tools. Prüfwerk exposes security data through MCP so AI assistants can query findings, SBOMs, and DAST results.
 
 **PKCE (Proof Key for Code Exchange)**
-An extension to the OAuth 2.0 authorization code flow that prevents authorization code interception attacks. Used in Certifai's authentication flow.
+An extension to the OAuth 2.0 authorization code flow that prevents authorization code interception attacks. Used in Prüfwerk's authentication flow.

docs/reference/plc-runtimes.md

@@ -4,9 +4,9 @@ A soft PLC is a **SoC + Linux + a software runtime + an IEC 61131-3 control app*
 (see [PLC / SPS Projects](/guide/plc)).
 The **runtime** is what defines the device — it provides the IEC engine, the
 Modbus / OPC UA / EtherNet/IP servers, and the WebVisu. This page tracks the
-runtime ecosystems Certifai may encounter.
+runtime ecosystems Prüfwerk may encounter.
 
-We do **not** aim to support every runtime up front. Certifai supports the
+We do **not** aim to support every runtime up front. Prüfwerk supports the
 **CODESYS family** today; everything else is a **watch-list** — when a customer
 shows up using one, we add the parser/support for it then. The dynamic OT probe
 (Modbus / OPC UA / EtherNet/IP) is **vendor-agnostic** and works regardless of

docs/reference/tools.md

@@ -1,12 +1,12 @@
 # Tools & Scanners
 
-Certifai uses a combination of open-source scanners and AI-powered analysis to provide comprehensive security coverage. This page describes each tool and how it contributes to the scan pipeline.
+Prüfwerk uses a combination of open-source scanners and AI-powered analysis to provide comprehensive security coverage. This page describes each tool and how it contributes to the scan pipeline.
 
 ## Semgrep -- Static Analysis (SAST)
 
 [Semgrep](https://semgrep.dev/) is an open-source static analysis tool that finds vulnerabilities by matching patterns in source code. It supports many languages and has an extensive rule library.
 
-Certifai runs Semgrep with rules covering:
+Prüfwerk runs Semgrep with rules covering:
 
 - **OWASP Top 10** -- injection, broken authentication, XSS, insecure deserialization, and more
 - **General security** -- insecure cryptography, hardcoded credentials, path traversal
@@ -26,7 +26,7 @@ Syft output feeds into both the SBOM feature and the vulnerability scanning pipe
 
 ## OSV.dev + NVD -- Vulnerability Matching
 
-Certifai matches every SBOM component directly against two public vulnerability sources (no separate scanner binary):
+Prüfwerk matches every SBOM component directly against two public vulnerability sources (no separate scanner binary):
 
 - [OSV.dev](https://osv.dev/) -- batch queried by package URL (purl) for ecosystem advisories (npm, PyPI, crates.io, Go, Maven, ...)
 - [NVD](https://nvd.nist.gov/) -- queried per CVE for the CVSS v3.1 base score, and by CPE for CODESYS runtime versions found in PLC projects
@@ -63,7 +63,7 @@ Detects hardcoded secrets and credentials in source code:
 
 ## LLM-Powered Code Review
 
-Beyond rule-based scanning, Certifai uses an LLM to perform architectural and security code review. The AI reviews code patterns that are too nuanced for static rules, such as:
+Beyond rule-based scanning, Prüfwerk uses an LLM to perform architectural and security code review. The AI reviews code patterns that are too nuanced for static rules, such as:
 
 - Business logic flaws
 - Race conditions