[Feature]: Data Contract Certification + Publication (end-to-end)

Parent PRD

#86

What to build

Extend certification and publication scope to Data Contracts, reusing the infrastructure built for Data Products.

Add certification columns (certification_level, inherited_certification_level, certified_at, certified_by, certification_expires_at, certification_notes) and publication columns (publication_scope, published_at, published_by) to the data_contracts table. Drop the old published boolean column. Implement contract-specific certify/decertify and publish/unpublish API endpoints with the same patterns as products. Migrate existing contract data (status="certified" and published=True). Wire CertificationBadge and PublicationBadge components into the contract list and detail pages.

Refer to the parent PRD "Entity Scope" section: Data Contracts get all three dimensions.

Acceptance criteria

• Alembic migration adds certification columns and replaces published boolean with publication_scope on data_contracts
• Existing contract data migrated (status="certified" -> active + top cert level; published=True -> publication_scope="organization")
• POST/DELETE /api/data-contracts/{id}/certify endpoints with Steward/Admin RBAC
• POST/DELETE /api/data-contracts/{id}/publish endpoints with active-status prerequisite
• Auto-unpublish on contract deprecation
• CertificationBadge and PublicationBadge shown in contract list table and detail page
• Unit tests for contract certify/publish logic
• Demo data files updated

Blocked by

• Blocked by #89 (reuses CertificationBadge and cert infrastructure)
• Blocked by #90 (reuses PublicationBadge and pub infrastructure)

User stories addressed

From PRD #86:

• User story 4: Separate visual indicators for certification, publication, and status on each entity

Start with parent PRD #86 and the certification and publication work in blocked issues #89 and #90. Trace the Alembic migration for data_contracts, the contract certify/publish endpoints, the contract list and detail pages, unit tests, and demo data files. Done means all acceptance criteria pass, including data migration, RBAC, active-status and deprecation behavior, badges, and tests.