- Certificate: Hardcode approval gate — completely removed the auto-issue path;
`certRequiresApproval()` now strictly returns `true`, ignoring DB configuration.
- Certificate: Quiz completion now queues a pending record and triggers a
"Pending approval" notification instead of falsely confirming issuance.
- Certificate: Public endpoints now enforce a guard on `status=issued`; frontend
strips the auto-issue side effect and claim button (issuance restricted to admins).
- Chats tab: Refactor layout into a full-width centered banner above two
equal-height side-by-side panels (`grid-cols-1 lg:grid-cols-2`), utilizing
`max-h` and `overflow-y-auto` to eliminate whitespace bleed.
- Video player: Fix settings flyout prematurely closing on mouse movement (removed
`setSettingsOpen` from `poke`); add a click-outside listener via `mousedown`.
- Video player: Deduplicate controls — the speed pill now directly cycles playback
speed, leaving the gear icon as the single entry point for settings (eliminating
overlapping popovers).
- Video player: Implement full-bleed theater mode using the `-mx-[50vw] w-screen`
technique, keeping the progress strip constrained to `max-w-5xl` below.
- Raise Traefik read timeout to 1h (compose dev/prod + k3s HelmChartConfig)
so admin video uploads up to 200MB no longer 502 mid-upload.
- Migration 0029: cascade watch/quiz history on lesson delete and unlink
dependent lessons, so removing a lesson or chapter stops 500ing.
- Add the Apollo cluster Helm overlay (values-apollo.yaml) for the deployed
environment.
- k3s Traefik chart config also enables access logs, cross-namespace
IngressRoutes, and fixes the Prometheus scrape port.
Bump appVersion/product.go/values tags to 0.2.1; chart version 0.2.3.
Shared NAT egress makes client IP unusable for uniqueness checks. Gate the
behavior behind REGISTRATION_ENFORCE_IP (default false) for public/invite signup.
ahp