docs: add per-finding verification notes

Each of the 13 findings was independently re-verified by reading the
actual code. All confirmed. Several findings refined with better line
ranges, broader scope, or downgraded severity:

- #4: clarified courseAccessStorageService is the REFERENCE pattern,
  not a second instance of the bug (correction to original framing)
- #6: bands are not duplicates; they serve different semantic purposes
  (decision vs message refinement) — reframed from 'duplicated' to
  'scattered & undocumented'
- #7: test at :551 explicitly asserts the catch-all; fix must update
  the test contract
- #8: 6 coercion sites across 4 parsers, not just line 52
- #9: method is 172 lines with ~8 responsibilities; timers are local
  vars, not class fields
- #10,#13: reclassified as design/style smells rather than bugs
- #11: mitigated by 401 handler — narrow real-world impact

Author: Predixx