Quiz: an attempt that did not pass is emailed and verified as a certificate #1744

Problem

SubmissionHandler::process_submission() always inserts a submission as publish. It gives the row an auth code and a magic token, then schedules the async email pipeline. For a quiz, SubmissionPersister lowers the status to quiz_in_progress or quiz_failed only after that insert. Nothing downstream reads the status:

• SubmissionHandler::dispatch_async_pipeline() rehydrates the row and fires the pipeline, and EmailHandler sends the certificate email. A participant who fails the first attempt therefore receives a working certificate link whenever the form sends the user email.
• Verification by auth code and by magic link (VerificationHandler, SubmissionReader::findByAuthCode / findByToken) and the REST lookup by auth code accept any status except trash. The code of a failed attempt verifies as a valid certificate.
• The user dashboard lists every non-trash row.

Acceptance criteria

• The async pipeline does nothing for a row that is not publish when it fires.
• Verification by auth code and by magic link refuses a quiz attempt that has not passed.
• The REST lookup by auth code refuses it too.
• The user dashboard does not list it as a certificate.
• Regression tests for each, CHANGELOG.