Decide the Explorer threshold: 3, not 2

WEBCERTI-19 webcertify Backlog high

Issue certificates as A4 landscape PDFs

WEBCERTI-16 webcertify Done high

Repair the source attendance data before trusting the counts

WEBCERTI-20 webcertify Backlog

Rebuild the generated certificate to match the client's templates

WEBCERTI-18 webcertify Done

Epic: webcertify production launch

WEBCERTI-9 webcertify Backlog

└─ Visual redesign: modern, sleek look and feel across all pages

WEBCERTI-15 webcertify Done high

└─ Prod: POST /auth/login returns 500

WEBCERTI-10 webcertify Done high

└─ Enable Google OAuth provider on Supabase (client id/secret + redirect URI)

WEBCERTI-2 webcertify Done

└─ Google Cloud OAuth client for webcertify sign-in

WEBCERTI-12 webcertify Done

└─ Contrast-checked semantic color tokens plus light/dark/system theme

WEBCERTI-13 webcertify Done

└─ End-to-end prod ingest test: upload a real Zoom .xlsx on webcertify.pensanta.com, confirm preview, commit, KPIs

WEBCERTI-7 webcertify Backlog

└─ Bootstrap app_users <-> auth.users: 0 auth users, 2 app_users

WEBCERTI-6 webcertify Done

└─ Supabase CLI: project-scoped SUPABASE_ACCESS_TOKEN in agent settings.local.json

WEBCERTI-3 webcertify Done low

└─ Bind sign-in identity to the Google sub, not the claim email

WEBCERTI-14 webcertify Backlog low

└─ RLS disabled on all 10 public tables

WEBCERTI-5 webcertify Done low

└─ Migration history: supabase_migrations.schema_migrations absent - CLI db push would re-apply all 5 migrations

WEBCERTI-4 webcertify Backlog low

└─ Vercel prod env vars: DATABASE_URL (pooler, password), NEXT_PUBLIC_SUPABASE_URL, NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY, APP_ORIGIN

WEBCERTI-1 webcertify Done low

└─ Vercel MCP: integration grant lacks webcertify-pensanta-com

WEBCERTI-11 webcertify Backlog someday

└─ Delegate audit/tests to coder-webcertify-ca

WEBCERTI-8 webcertify Done someday

GitHub to Vercel did not trigger a deployment for commit b8dd248

WEBCERTI-17 webcertify Backlog low