[10] course-registry README.md is severely out of date — describes an API that doesn't exist #10

Problem Statement

contracts/course-registry/README.md describes an API contract that doesn't match the actual code:

• README claims create_course(env, admin, id, title) where title: Symbol. Actual code: create_course(env, admin, instructor, total_modules, metadata_hash) where metadata_hash: BytesN<32>.
• README claims get_course(env, id) -> (u32, Symbol, bool). Actual: get_course(env, id) -> Course — full struct (instructor, total_modules, metadata_hash, active).
• README's "Events" section documents ("created", course_id) and ("status", course_id) topics. Actual events are typed structs CourseCreated and CourseStatusChanged.
• README mentions ("course", id) storage keys; actual is DataKey::Course(id) with a DataKey::Admin/BadgeNftAddress/RewardPoolAddress set.
• README describes authentication as "enforced at the invocation layer" and suggests uncommenting admin.require_auth() for production. This is dangerous advice — initialize today never had that auth (see Issue [1] course-registry::initialize is missing require_auth — critical authorization bypass #1); the rest of the admin functions already call require_auth.

Why It Matters

• A new contributor reading the README will spend hours confused about which API is canonical.
• Frontend teams will build against the documented Symbol-based API and fail integration.
• Misleading security guidance ("uncomment for production") will tempt changes that look correct but break.

Technical Context

• All six contracts need this audit; course-registry is the worst offender.
• The actual codebase has drfit-proof typed events via #[contractevent].

Expected Outcome

A complete rewrite of contracts/course-registry/README.md covering:

• Actual function signatures with parameters, return types, panic conditions.
• Event types as documented rustdoc-style.
• Storage layout table including RewardPoolAddress and BadgeNftAddress.
• The cross-contract wiring required for end-to-end operation.
• Auth model: who can call what, plus Issue [1] course-registry::initialize is missing require_auth — critical authorization bypass #1's fix.

Acceptance Criteria

• README signatures exactly match contracts/course-registry/src/lib.rs.
• Verified by a CI step that runs cargo doc --no-deps and asserts each public method is documented.
• Storage layout table includes every DataKey::* variant.

Implementation Notes

• Generate from rustdoc via tooling: cargo doc and pipe into Markdown.
• Reference the Orivex workspace's documentation style from rewards-pool/README.md for tone consistency.

Files / Modules Affected

• contracts/course-registry/README.md
• (Optional) drift detector in CI.

Dependencies

Issue #1 should be merged first so docs reflect the corrected auth.

Difficulty

Easy.

Estimated Effort

3–4 hours.

Suggested Labels

documentation, P1, course-registry, drift