Create a certificate on the company an answer request is about

Creates a certificate as the answer to a CERTIFICATE question, on the company the request is about. The target company comes from the request's onBehalfOfCompanyId and is deliberately not accepted in the body. Only the answering company may call it, and only while the brand that issued the request is still connected to it; anyone else gets 404 request_not_found. Replaces POST /v3/claims for this flow, which inserted the claim and copied its file into private storage and then read the row back through a network-scoped query — so a delegated answering party got a 404 after the write, leaving a claim no read path can see, and a duplicate check scoped to the caller that could not find it, so every retry wrote another. Here the read-back is unscoped and the duplicate check is scoped to the company the certificate is actually filed on. The certificate is created in REQUESTED state; status is not client-settable. Required and optional fields mirror POST /api/claims, so only the standard and the two dates are required; a file is optional and, when given, must belong to the caller. Responds 201.