-- Add manual approval flow for certificates.
-- Existing certs keep status='issued'. New completions create status='pending'
-- until an admin or mentor explicitly issues the certificate.

ALTER TABLE certificates ADD COLUMN IF NOT EXISTS status TEXT NOT NULL DEFAULT 'issued';
ALTER TABLE certificates ALTER COLUMN public_id DROP NOT NULL;

UPDATE certificates SET status = 'issued';

INSERT INTO app_settings (key, value) VALUES
  ('certificate_enabled', 'true'),
  ('certificate_requires_approval', 'true')
ON CONFLICT (key) DO NOTHING;