test(api): request tests for certification ships endpoint

[dhamariT]

Request tests for the certification ships endpoint from #215, kept out of that PR to keep its diff focused. They cover auth rejection, the default 24 hour window, explicit since/until windows, the status filter, the soft-deleted project exclusion, and the 400s on invalid time params.

This branches off #215 so the diff shows its commits too until it merges, after which this collapses to just the test file. Merge #215 first.

One note on the setup: you can't stub Rails.application.credentials with minitest's stub because EncryptedConfiguration's method_missing swallows the call as a credential lookup, and mutating credentials.config does nothing since dig reads a memoized options hash. The test injects the API key by mutating that options hash in setup and removing it in teardown.

---

Note

Medium Risk
New external read API exposes certification and project data including Slack IDs; risk is mitigated by Bearer API keys and read-only access but credential scope and data exposure warrant review.

Overview
Adds a read-only JSON API for certification shipwrights at GET /api/v1/certification/ships, wired under Api::V1::Certification with API keys from certification_shipwrights credentials (separate from ambassador referral keys).

The index action returns certification ships in a configurable time window (default last 24 hours via hours, or since/until), optional status filtering, excludes soft-deleted projects, and serializes ship review metadata plus nested project, owner, and reviewer fields (including Slack IDs). Invalid time/hours params return 400 via InvalidParam.

Integration tests exercise Bearer auth rejection, the default window, since/until, status filter, deleted-project exclusion, and bad params; setup mutates the memoized credentials options hash because Rails.application.credentials cannot be stubbed normally.

^{Reviewed by Cursor Bugbot for commit 2aaf7cf. Bugbot is set up for automated code reviews on this repo. Configure here.}