- Certificate: Hardcode approval gate — completely removed the auto-issue path;
`certRequiresApproval()` now strictly returns `true`, ignoring DB configuration.
- Certificate: Quiz completion now queues a pending record and triggers a
"Pending approval" notification instead of falsely confirming issuance.
- Certificate: Public endpoints now enforce a guard on `status=issued`; frontend
strips the auto-issue side effect and claim button (issuance restricted to admins).
- Chats tab: Refactor layout into a full-width centered banner above two
equal-height side-by-side panels (`grid-cols-1 lg:grid-cols-2`), utilizing
`max-h` and `overflow-y-auto` to eliminate whitespace bleed.
- Video player: Fix settings flyout prematurely closing on mouse movement (removed
`setSettingsOpen` from `poke`); add a click-outside listener via `mousedown`.
- Video player: Deduplicate controls — the speed pill now directly cycles playback
speed, leaving the gear icon as the single entry point for settings (eliminating
overlapping popovers).
- Video player: Implement full-bleed theater mode using the `-mx-[50vw] w-screen`
technique, keeping the progress strip constrained to `max-w-5xl` below.
- Raise Traefik read timeout to 1h (compose dev/prod + k3s HelmChartConfig)
so admin video uploads up to 200MB no longer 502 mid-upload.
- Migration 0029: cascade watch/quiz history on lesson delete and unlink
dependent lessons, so removing a lesson or chapter stops 500ing.
- Add the Apollo cluster Helm overlay (values-apollo.yaml) for the deployed
environment.
- k3s Traefik chart config also enables access logs, cross-namespace
IngressRoutes, and fixes the Prometheus scrape port.
Bump appVersion/product.go/values tags to 0.2.1; chart version 0.2.3.
SetupTracing merged resource.Default() (schema 1.43.0 under otel 1.45.0)
with semconv/v1.24.0's schema URL, so resource.Merge errored with
'conflicting Schema URL' and the backend exited at startup whenever an
OTLP endpoint was configured. resource.NewSchemaless keeps service.name
without pinning a schema, surviving otel major bumps.
Keep Next on the patched 15.5 line instead of the Next 16 Dependabot bump, and move OpenTelemetry and gRPC to the versions that close the open Go alerts.
Shared NAT egress makes client IP unusable for uniqueness checks. Gate the
behavior behind REGISTRATION_ENFORCE_IP (default false) for public/invite signup.
ahp