[Feature]: Dataset + Asset Certification (end-to-end)

Parent PRD

#86

What to build

Extend certification to Datasets and Assets (Tables, Views, etc.), without publication (by design -- these entities inherit marketplace visibility from their parent Data Product).

Add certification columns (certification_level, inherited_certification_level, certified_at, certified_by, certification_expires_at, certification_notes) to the datasets and assets tables. Implement certify/decertify API endpoints for both entity types with Steward/Admin RBAC. Wire the CertificationBadge into dataset and asset list/detail pages.

Refer to the parent PRD "Entity Scope" section: Datasets and Assets get Status + Certification only.

Acceptance criteria

• Alembic migration adds certification columns to datasets and assets tables
• POST/DELETE /api/datasets/{id}/certify endpoints with Steward/Admin RBAC
• POST/DELETE /api/assets/{id}/certify endpoints with Steward/Admin RBAC
• No publication fields on datasets or assets (by design)
• CertificationBadge shown in dataset list/detail and asset list/detail pages
• Unit tests for dataset and asset certification logic

Blocked by

• Blocked by #89 (reuses certification infrastructure from Data Product Certification)

User stories addressed

From PRD #86:

• User story 7: Producer sees effective certification level on downstream entities

Read PRD #86 and the certification infrastructure from blocked issue #89 first. Trace the dataset and asset API endpoints plus their list/detail pages, then verify the migration, Steward/Admin checks, inherited visibility behavior, badge coverage, and unit tests against the acceptance criteria. Done means both entity types support certification without publication fields.