feat: manual cert gating, chat layout overhaul, and video player UX fixes

- Certificate: Hardcode approval gate — completely removed the auto-issue path;
  `certRequiresApproval()` now strictly returns `true`, ignoring DB configuration.
- Certificate: Quiz completion now queues a pending record and triggers a
  "Pending approval" notification instead of falsely confirming issuance.
- Certificate: Public endpoints now enforce a guard on `status=issued`; frontend
  strips the auto-issue side effect and claim button (issuance restricted to admins).
- Chats tab: Refactor layout into a full-width centered banner above two
  equal-height side-by-side panels (`grid-cols-1 lg:grid-cols-2`), utilizing
  `max-h` and `overflow-y-auto` to eliminate whitespace bleed.
- Video player: Fix settings flyout prematurely closing on mouse movement (removed
  `setSettingsOpen` from `poke`); add a click-outside listener via `mousedown`.
- Video player: Deduplicate controls — the speed pill now directly cycles playback
  speed, leaving the gear icon as the single entry point for settings (eliminating
  overlapping popovers).
- Video player: Implement full-bleed theater mode using the `-mx-[50vw] w-screen`
  technique, keeping the progress strip constrained to `max-w-5xl` below.

frontend/src/components/profile-certificate-slot.tsx

@@ -1,8 +1,8 @@
 "use client";
 
-import { useEffect, useRef, useState } from "react";
+import { useState } from "react";
 import { useRouter } from "next/navigation";
-import { useQuery, useQueryClient } from "@tanstack/react-query";
+import { useQuery } from "@tanstack/react-query";
 import { Award, Clock, Copy, ExternalLink, Loader2, Lock } from "lucide-react";
 import { http, toUserError } from "@/lib/api";
 import type { Certificate } from "@/lib/types";
@@ -17,9 +17,6 @@ type MineCertificateResponse = {
 
 export function ProfileCertificateSlot() {
   const router = useRouter();
-  const qc = useQueryClient();
-  const [issuing, setIssuing] = useState(false);
-  const autoIssueTried = useRef(false);
 
   const { data, isLoading, isError, error, refetch } = useQuery({
     queryKey: ["me", "certificate"],
@@ -29,18 +26,6 @@ export function ProfileCertificateSlot() {
   const cert = data?.certificate ?? null;
   const eligible = !!data?.eligible;
 
-  // Auto-issue once when the student becomes eligible (same path as /cap).
-  useEffect(() => {
-    if (!eligible || cert || autoIssueTried.current) return;
-    autoIssueTried.current = true;
-    setIssuing(true);
-    void http
-      .post<{ certificate: Certificate }>("/api/me/certificate/issue", {})
-      .then(() => qc.invalidateQueries({ queryKey: ["me", "certificate"] }))
-      .catch((e) => toast.error(toUserError(e, "صدور خودکار گواهینامه ممکن نشد — دستی تلاش کنید")))
-      .finally(() => setIssuing(false));
-  }, [eligible, cert, qc]);
-
   const copyLink = async () => {
     if (!cert?.publicId) return;
     const url = `${window.location.origin}/c/${cert.publicId}`;
@@ -57,21 +42,6 @@ export function ProfileCertificateSlot() {
     router.push(`/c/${cert.publicId}`);
   };
 
-  const claim = async () => {
-    setIssuing(true);
-    try {
-      const res = await http.post<{ certificate: Certificate }>("/api/me/certificate/issue", {});
-      await qc.invalidateQueries({ queryKey: ["me", "certificate"] });
-      if (res.certificate?.publicId) {
-        router.push(`/c/${res.certificate.publicId}`);
-      }
-    } catch (e) {
-      toast.error(toUserError(e, "صدور گواهینامه ممکن نشد"));
-    } finally {
-      setIssuing(false);
-    }
-  };
-
   return (
     <section
       aria-label="جایگاه گواهینامه"
@@ -94,7 +64,7 @@ export function ProfileCertificateSlot() {
             تلاش دوباره
           </Button>
         </div>
-      ) : isLoading || (eligible && !cert && issuing) ? (
+      ) : isLoading ? (
         <div className="flex items-center gap-2 py-3 text-xs text-muted-foreground">
           <Loader2 className="h-3.5 w-3.5 animate-spin" />
           در حال بارگذاری…
@@ -132,14 +102,14 @@ export function ProfileCertificateSlot() {
           </div>
         </div>
       ) : eligible ? (
-        <div className="space-y-2.5">
-          <p className="text-[11px] leading-relaxed text-muted-foreground">
-            دوره را تمام کرده‌اید. گواهینامه دیجیتال آمادهٔ صدور است.
-          </p>
-          <Button type="button" size="sm" className="h-8 w-full" disabled={issuing} onClick={() => void claim()}>
-            {issuing ? <Loader2 className="h-3.5 w-3.5 animate-spin" /> : <Award className="h-3.5 w-3.5" />}
-            دریافت گواهینامه
-          </Button>
+        <div className="flex items-start gap-2 rounded-lg border border-border/70 bg-background/60 px-3 py-2.5">
+          <Clock className="mt-0.5 h-3.5 w-3.5 shrink-0 text-warning" />
+          <div>
+            <p className="text-[11px] font-bold text-foreground">در انتظار تأیید</p>
+            <p className="mt-0.5 text-[10px] leading-relaxed text-muted-foreground">
+              درخواست گواهینامه ثبت شد و پس از بررسی توسط تیم آموزش صادر می‌شود.
+            </p>
+          </div>
         </div>
       ) : (
         <div