docs: rebrand Certifai -> Prüfwerk (user-facing name)

The product is renamed Certifai -> Prüfwerk. This changes only the user-facing
brand text in the documentation (docs/**, VitePress title/name). It does NOT
touch functional identifiers that happen to contain "certifai" (the Docker
network, Keycloak realm/client, Harbor image project, the compliance-* crate
names, or the repo name) — those are infra-coupled and need a separate,
coordinated migration.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EgxGHn22YEfQz5fLHSHkLv

docs/reference/tools.md

@@ -1,12 +1,12 @@
 # Tools & Scanners
 
-Certifai uses a combination of open-source scanners and AI-powered analysis to provide comprehensive security coverage. This page describes each tool and how it contributes to the scan pipeline.
+Prüfwerk uses a combination of open-source scanners and AI-powered analysis to provide comprehensive security coverage. This page describes each tool and how it contributes to the scan pipeline.
 
 ## Semgrep -- Static Analysis (SAST)
 
 [Semgrep](https://semgrep.dev/) is an open-source static analysis tool that finds vulnerabilities by matching patterns in source code. It supports many languages and has an extensive rule library.
 
-Certifai runs Semgrep with rules covering:
+Prüfwerk runs Semgrep with rules covering:
 
 - **OWASP Top 10** -- injection, broken authentication, XSS, insecure deserialization, and more
 - **General security** -- insecure cryptography, hardcoded credentials, path traversal
@@ -26,7 +26,7 @@ Syft output feeds into both the SBOM feature and the vulnerability scanning pipe
 
 ## OSV.dev + NVD -- Vulnerability Matching
 
-Certifai matches every SBOM component directly against two public vulnerability sources (no separate scanner binary):
+Prüfwerk matches every SBOM component directly against two public vulnerability sources (no separate scanner binary):
 
 - [OSV.dev](https://osv.dev/) -- batch queried by package URL (purl) for ecosystem advisories (npm, PyPI, crates.io, Go, Maven, ...)
 - [NVD](https://nvd.nist.gov/) -- queried per CVE for the CVSS v3.1 base score, and by CPE for CODESYS runtime versions found in PLC projects
@@ -63,7 +63,7 @@ Detects hardcoded secrets and credentials in source code:
 
 ## LLM-Powered Code Review
 
-Beyond rule-based scanning, Certifai uses an LLM to perform architectural and security code review. The AI reviews code patterns that are too nuanced for static rules, such as:
+Beyond rule-based scanning, Prüfwerk uses an LLM to perform architectural and security code review. The AI reviews code patterns that are too nuanced for static rules, such as:
 
 - Business logic flaws
 - Race conditions