feat(certifications): schema + RLS + permissions (data layer)

Migration 030 adds certifications (per-space cert types, optional
validity_months, is_active archive) and member_certifications (per-member
grants; expires_at snapshotted at grant time; soft revoke; partial unique
on one active grant per member+cert). RLS is additive and default-deny:
cert types readable by any space member, write-gated by
certifications.manage; grants readable by managers/granters (all) or the
member (own), written by certifications.grant, with no DELETE policy so
the history is immutable. No anonymous path.

Two new permission codes in the catalog (group Certifications):
certifications.manage and certifications.grant (the Instructor
capability, assignable to any role via the existing additive model).
Seeded to board and backfilled. Mirrored idempotently in schema.sql;
types and schema docs updated.

lib/permissions-catalog.ts

@@ -22,6 +22,8 @@ export const PERMISSIONS = [
   { code: 'governance.manage',  group: 'Governance', label: 'Manage proposals, incidents, policies' },
   { code: 'forum.moderate',     group: 'Community', label: 'Moderate forum and comments' },
   { code: 'forms.manage',       group: 'Community', label: 'Manage forms and waivers' },
+  { code: 'certifications.manage', group: 'Certifications', label: 'Manage certification types' },
+  { code: 'certifications.grant',  group: 'Certifications', label: 'Award and revoke certifications (Instructor)' },
   { code: 'customize.manage',   group: 'Admin', label: 'Customize roles, tiers, areas, invites, onboarding' },
   { code: 'settings.manage',    group: 'Admin', label: 'Space settings, integrations, webhooks' },
 ] as const
@@ -40,7 +42,9 @@ export const DEFAULT_ROLE_PERMISSIONS: Record<string, PermissionCode[]> = {
     'ops.kb.read', 'ops.kb.write', 'ops.process.read', 'ops.process.write',
     'ops.secrets.read', 'ops.secrets.write', 'ops.arealeads.manage',
     'members.manage', 'payments.manage', 'governance.manage',
-    'forum.moderate', 'forms.manage', 'customize.manage', 'settings.manage',
+    'forum.moderate', 'forms.manage',
+    'certifications.manage', 'certifications.grant',
+    'customize.manage', 'settings.manage',
   ],
   treasurer: ['payments.manage', 'ops.kb.read', 'ops.process.read'],
   member: ['ops.kb.read', 'ops.process.read'],