feat: update verify page for HTML and PDF uploads

[gkanitz]

What to build

Update `docs/verify/` to accept `report.html` and `report.pdf` uploads (clean break from the old `report.json` path). Pre-fill repo and subject from URL parameters so QR code scans land on a ready-to-use page.

URL parameter pre-fill
On page load, read `?repo=` and `?subject=` from the URL and pre-populate the UI. A QR code scan from a printed PDF delivers both, so the recruiter only needs to upload the file.

HTML upload path

1. Hash the full HTML file bytes with SHA-256 (existing `sha256Hex` helper)
2. Extract `verification.repository` from the embedded `<script type="application/json" id="coderepute-report">` tag
3. Look up the attestation via `fetchAttestation(repo, digest)` → Rekor fallback as today

PDF upload path

1. Hash the full PDF file bytes
2. Read repo from URL params (primary); if absent, parse the PDF's XMP metadata for `coderepute:repo` (the `` tags Chromium preserves); if absent, show a text input asking the user to enter the repo
3. Look up attestation by hash — same API call as HTML path

Clean break
Remove the existing JSON upload path entirely. Update UI copy and file-type hints to reference `report.html` / `report.pdf`. Update the verify page URL to `https://grkanitz.github.io/CodeRepute/verify/\` (interim until `coderepute.dev` is registered — see #34).

For XMP extraction from PDF, use the `pdf-lib` or `pdfjs-dist` library already available in the browser, or parse the raw PDF bytes for the XMP stream — choose whichever adds least weight to the page.

Acceptance criteria

• Uploading `report.html` from a CI run verifies successfully (attestation found, workflow identity matches)
• Uploading `report.pdf` from a CI run verifies successfully
• Visiting `?repo=owner/repo&subject=alice` pre-fills the UI before any file is uploaded
• When URL params are absent and a PDF is uploaded, the page attempts XMP extraction then falls back to a repo text input
• JSON upload path is removed; uploading a `.json` file shows a clear error or is not accepted
• Existing `verify.test.js` tests updated; `npm test` passes

Blocked by

• feat: embed report JSON in HTML and update footer verify link + QR code #35

[gkanitz]

Status: implementation landed via PR #43 (this issue was never closed). Remaining work is end-to-end validation against a fresh CI run on the live domain — tracked in #57 (Launch readiness). Note: the interim verify URL in this issue's body predates the account rename; the constant check is part of #57. Close this issue when #57's HTML/PDF upload boxes are ticked.