feat(certifications): per-member award/revoke panel on Members

A "Certs" column appears for anyone holding certifications.grant (the
Instructor capability), independent of admin/board, so a non-admin
instructor can reach it. The button opens a self-contained dialog that
loads the member's grants and the active cert catalog, and supports
award (with optional note + expiry override), soft revoke, and renew.
Status badges come from the shared certifications-logic. The members
server page resolves certifications.grant via the RPC and passes it in.

app/(app)/members/page.tsx

@@ -87,10 +87,20 @@ export default async function MembersPage() {
         .order('created_at', { ascending: false })
     : { data: [] }
 
+  // certifications.grant (the Instructor capability) is independent of
+  // admin/board, so check it explicitly to decide whether to show the
+  // per-member certifications panel.
+  const { data: canGrantCerts } = await supabase.rpc('user_has_permission', {
+    uid: user.id,
+    sid: self.space_id,
+    perm: 'certifications.grant',
+  })
+
   return (
     <MembersClient
       members={members ?? []}
       currentRole={self.role}
+      canGrantCerts={!!canGrantCerts}
       areaLeadRoles={(areaLeadRoles ?? []) as Array<{ id: string; area_name: string; lead_id: string | null }>}
       inviteSlot={
         canInvite ? (