release v0.3.9: bump frontend image tags

- Rename chapter labels from "هفتهٔ N" to "فصل N" in skill-tree
  - Show dashed "پیش‌نویس" badge on unpublished chapters/lessons for staff
  - Add isPublished to TreeLesson type (backend already exposes it)
  - Fix chat FAB and notification banner overlapping bottom nav on mobile

deploy/helm/pargar/Chart.yaml

@@ -2,8 +2,8 @@ apiVersion: v2
 name: pargar
 description: Pargar gated LMS - Go API, Next.js frontend, Postgres, Redis, S3-compatible storage
 type: application
-version: 0.2.3
-appVersion: "0.2.1"
+version: 0.2.4
+appVersion: "0.3.7"
 keywords:
   - lms
   - pargar

deploy/helm/pargar/templates/secret-data.yaml

@@ -8,7 +8,10 @@
 {{- else if and .Values.postgres.auth.password (not (hasPrefix "change-me" .Values.postgres.auth.password)) (ne .Values.postgres.auth.password "") }}
   {{- $pgPass = .Values.postgres.auth.password }}
 {{- else }}
-  {{- $pgPass = randAlphaNum 32 }}
+  {{- /* Fail loudly instead of silently minting a random password: under
+         Argo CD (helm template) `lookup` is always empty, and a random
+         value would diverge from the live service on every render. */}}
+  {{- fail "postgres.auth.password must be set: no existing pargar-postgres secret was found and .Values.postgres.auth.password is empty or a change-me placeholder" }}
 {{- end }}
 apiVersion: v1
 kind: Secret
@@ -30,7 +33,7 @@ stringData:
 {{- else if and .Values.redis.auth.password (not (hasPrefix "change-me" .Values.redis.auth.password)) (ne .Values.redis.auth.password "") }}
   {{- $rdPass = .Values.redis.auth.password }}
 {{- else }}
-  {{- $rdPass = randAlphaNum 32 }}
+  {{- fail "redis.auth.password must be set: no existing pargar-redis secret was found and .Values.redis.auth.password is empty or a change-me placeholder" }}
 {{- end }}
 apiVersion: v1
 kind: Secret
@@ -56,7 +59,7 @@ stringData:
 {{- else if and .Values.rustfs.auth.secretKey (not (hasPrefix "change-me" .Values.rustfs.auth.secretKey)) (ne .Values.rustfs.auth.secretKey "") }}
   {{- $secret = .Values.rustfs.auth.secretKey }}
 {{- else }}
-  {{- $secret = randAlphaNum 40 }}
+  {{- fail "rustfs.auth.secretKey must be set: no existing pargar-rustfs secret was found and .Values.rustfs.auth.secretKey is empty or a change-me placeholder" }}
 {{- end }}
 apiVersion: v1
 kind: Secret

deploy/helm/pargar/templates/servicemonitor.yaml

@@ -0,0 +1,29 @@
+{{- if .Values.backend.metrics.serviceMonitor.enabled }}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: {{ include "pargar.fullname" . }}-backend
+  labels:
+    {{- include "pargar.labels" . | nindent 4 }}
+    app.kubernetes.io/component: backend
+spec:
+  selector:
+    matchLabels:
+      {{- include "pargar.selectorLabels" . | nindent 6 }}
+      app.kubernetes.io/component: backend
+  namespaceSelector:
+    matchNames:
+      - {{ .Release.Namespace }}
+  endpoints:
+    - port: http
+      path: /metrics
+      interval: {{ .Values.backend.metrics.serviceMonitor.interval | default "30s" }}
+      scheme: http
+      # /metrics answers 401 without it; Prometheus sends it as
+      # Authorization: Bearer <token>.
+      authorization:
+        type: Bearer
+        credentials:
+          name: {{ include "pargar.appSecretName" . }}
+          key: metrics-token
+{{- end }}

deploy/helm/pargar/values-apollo.yaml

@@ -11,7 +11,7 @@ backend:
   image:
     pullPolicy: IfNotPresent
     repository: pargar-backend
-    tag: 0.3.7
+    tag: 0.3.9
   metrics:
     serviceMonitor:
       enabled: true
@@ -41,7 +41,7 @@ frontend:
   image:
     pullPolicy: IfNotPresent
     repository: pargar-frontend
-    tag: 0.3.7
+    tag: 0.3.9
   podDisruptionBudget:
     enabled: false
   replicaCount: 2
@@ -58,7 +58,10 @@ global:
   # Images published by .gitea/workflows/build-and-push.yaml on tag push.
   imageRegistry: src.panahifar.ir/ahp
   publicUrl: https://pargar.panahifar.ir
-imagePullSecrets: []
+# Gitea packages are private: kubelet pulls need secret `gitea-pull`
+# (docker-registry secret for src.panahifar.ir, created in ns pargar).
+imagePullSecrets:
+  - name: gitea-pull
 ingress:
   enabled: true
   tls:

deploy/helm/pargar/values.yaml

@@ -25,6 +25,13 @@ backend:
     pullPolicy: IfNotPresent
   service:
     port: 8080
+  metrics:
+    # Prometheus Operator ServiceMonitor. /metrics is bearer-protected by
+    # METRICS_TOKEN, so the endpoint carries authorization credentials
+    # (pargar-app secret) instead of scraping anonymously.
+    serviceMonitor:
+      enabled: false
+      interval: 30s
   resources:
     requests:
       cpu: 50m

frontend/src/components/mentor-chat.tsx

@@ -3269,7 +3269,7 @@ ws.onmessage = (ev) => {
               setOpen(true);
               setNotif(null);
             }}
-            className="fixed bottom-24 start-5 end-5 z-[64] flex max-w-full items-center gap-2.5 rounded-2xl border-2 border-white/50 bg-card/85 p-2.5 text-right shadow-offset backdrop-blur-2xl sm:end-auto sm:max-w-[300px]"
+            className="fixed bottom-[calc(5.5rem+env(safe-area-inset-bottom,0px))] start-5 end-5 z-[64] flex max-w-full items-center gap-2.5 rounded-2xl border-2 border-white/50 bg-card/85 p-2.5 text-right shadow-offset backdrop-blur-2xl sm:bottom-24 sm:end-auto sm:max-w-[300px]"
           >
             <span className="grid h-9 w-9 shrink-0 place-items-center rounded-xl bg-accent/15">
               <MessageSquare className="h-4 w-4 text-accent" />
@@ -3286,7 +3286,9 @@ ws.onmessage = (ev) => {
       </AnimatePresence>
 
       {me && !open && (
-        <div className="fixed bottom-5 start-5 z-[64]">
+        // On mobile the bottom nav is 56px; lift FAB above it + safe area + gap.
+        // md:bottom-5 restores original position when the bottom nav is hidden.
+        <div className="fixed bottom-[calc(4.5rem+env(safe-area-inset-bottom,0px))] start-5 z-[64] md:bottom-5">
           <div className="relative">
             {unreadTotal > 0 && (
               <span className="pointer-events-none absolute -inset-1 -z-10 animate-ping rounded-2xl bg-accent/40" aria-hidden />

frontend/src/components/skill-tree.tsx

@@ -21,6 +21,7 @@ import {
 } from "lucide-react";
 import { useMemo, useState } from "react";
 import type { TreeChapter, TreeData, TreeLesson } from "@/lib/types";
+import { useAuth } from "@/lib/auth-store";
 import { cn, formatFaNumber } from "@/lib/utils";
 
 const CHAPTER_ICONS: Record<string, typeof Terminal> = {
@@ -38,6 +39,8 @@ const CHAPTER_ICONS: Record<string, typeof Terminal> = {
 
 export function SkillTree({ data, onSelect }: { data: TreeData; onSelect?: (id: number) => void }) {
   const router = useRouter();
+  const role = useAuth((s) => s.user?.role);
+  const isStaff = role === "admin" || role === "mentor";
 
   const chapters = useMemo(() => [...data.chapters].sort((a, b) => a.sortOrder - b.sortOrder), [data]);
   const byId = useMemo(() => {
@@ -97,6 +100,7 @@ export function SkillTree({ data, onSelect }: { data: TreeData; onSelect?: (id:
             open={expanded.has(ch.id)}
             onToggle={() => toggle(ch.id)}
             onSelect={onSelect ?? ((id: number) => router.push(`/player/${id}`))}
+            isStaff={isStaff}
           />
         ))}
       </div>
@@ -110,12 +114,14 @@ function ChapterRow({
   open,
   onToggle,
   onSelect,
+  isStaff,
 }: {
   ch: TreeChapter;
   byId: Map<number, TreeLesson>;
   open: boolean;
   onToggle: () => void;
   onSelect: (id: number) => void;
+  isStaff: boolean;
 }) {
   const lessons = [...(ch.lessons ?? [])].sort((a, b) => a.y - b.y || a.x - b.x);
   const done = lessons.filter((l) => l.progress?.passedQuiz).length;
@@ -147,8 +153,13 @@ function ChapterRow({
                 <CheckCircle2 className="h-3.5 w-3.5" /> کامل شد
               </span>
             )}
+            {isStaff && !ch.isPublished && (
+              <span className="hidden shrink-0 rounded-full border border-dashed border-warning/50 bg-warning/10 px-2 py-0.5 text-[11px] font-bold text-warning sm:inline-block">
+                پیش‌نویس
+              </span>
+            )}
             <span className="hidden shrink-0 rounded-full bg-muted px-2 py-0.5 text-[11px] font-bold text-muted-foreground sm:inline-block">
-              هفتهٔ {ch.sortOrder}
+              فصل {ch.sortOrder}
             </span>
           </div>
           <p className="truncate text-xs text-muted-foreground">{ch.description}</p>
@@ -173,7 +184,7 @@ function ChapterRow({
         <div className="overflow-hidden">
           <div className="grid gap-2.5 border-t-2 border-border/70 p-4 sm:grid-cols-2">
             {lessons.map((lesson) => (
-              <LessonRow key={lesson.id} lesson={lesson} byId={byId} onSelect={onSelect} />
+              <LessonRow key={lesson.id} lesson={lesson} byId={byId} onSelect={onSelect} isStaff={isStaff} />
             ))}
           </div>
         </div>
@@ -186,10 +197,12 @@ function LessonRow({
   lesson,
   byId,
   onSelect,
+  isStaff,
 }: {
   lesson: TreeLesson;
   byId: Map<number, TreeLesson>;
   onSelect: (id: number) => void;
+  isStaff: boolean;
 }) {
   const passed = !!lesson.progress?.passedQuiz;
   const locked = lesson.locked;
@@ -254,6 +267,11 @@ function LessonRow({
         </div>
         <div className="mt-1.5 flex flex-wrap items-center gap-2">
           <span className={cn("rounded-full px-2 py-0.5 text-[11px] font-bold", s.pill)}>{s.pillText}</span>
+          {isStaff && lesson.isPublished === false && (
+            <span className="rounded-full border border-dashed border-warning/50 bg-warning/10 px-2 py-0.5 text-[11px] font-bold text-warning">
+              پیش‌نویس
+            </span>
+          )}
           {inProgress && (
             <div className="h-1.5 w-24 overflow-hidden rounded-full bg-muted">
               <div className="h-full rounded-full bg-primary" style={{ width: `${pct}%` }} />

frontend/src/lib/types.ts

@@ -117,6 +117,7 @@ export interface TreeLesson {
   xpReward: number;
   durationSeconds: number;
   chapterId: number;
+  isPublished?: boolean;
 }
 
 export interface TreeChapter extends Chapter {