feat(verification): 教練審核流程完整版——狀態機/證照送審/Admin 裁決/通知

實作 openspec change provider-verification-workflow（25/25 tasks）：
- is_verified 升級為 verification_status 四狀態機（unsubmitted/pending/
  approved/rejected），migration 自動轉換既有資料，API 以 accessor 保留
  is_verified 相容輸出
- 教練端：證照上傳（≤3 張、複用 CompressesImages）、送審、駁回原因
  顯示與重送（/coach/verification 新頁面）
- Admin 端：審核佇列、通過/駁回（原因必填）、撤銷 approved；移除
  toggle-verified 端點（防繞過狀態機）；裁決後 flush 課程快取
- 通知：審核通過/駁回（站內+Email，駁回含原因）
- 可見性與預約入口改判 approved（行為等價）
- 測試 +18（ProviderVerificationTest 10、AdminVerificationTest 8），
  既有 4 個測試檔 helper 遷移；Swagger 同步
- 規格同步：provider-verification 全面改寫、admin-user-management
  toggle 段落改為移除聲明

容器內全套件 173 passed / 439 assertions。

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

app/Models/DivingOffer.php

@@ -55,14 +55,14 @@ class DivingOffer extends Model
     }
 
     /**
-     * 公開端點可見性：未驗證教練的課程不對外曝光。
+     * 公開端點可見性：未通過審核（approved）教練的課程不對外曝光。
      * provider_id 為 null 的課程（平台自有資料）不受此限制。
      */
     public function scopeVisibleToPublic(Builder $query): Builder
     {
         return $query->where(function (Builder $visible) {
             $visible->whereNull('provider_id')
-                ->orWhereHas('provider.providerProfile', fn (Builder $profile) => $profile->where('is_verified', true));
+                ->orWhereHas('provider.providerProfile', fn (Builder $profile) => $profile->where('verification_status', \App\Enums\VerificationStatus::Approved->value));
         });
     }
 

app/Models/ProviderCertification.php

@@ -0,0 +1,31 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Support\Facades\Storage;
+
+class ProviderCertification extends Model
+{
+    protected $fillable = [
+        'user_id',
+        'image_path',
+    ];
+
+    protected static function booted(): void
+    {
+        static::deleting(function ($certification) {
+            Storage::disk('public')->delete($certification->image_path);
+        });
+    }
+
+    public function getUrlAttribute(): string
+    {
+        return Storage::disk('public')->url($this->image_path);
+    }
+
+    public function user()
+    {
+        return $this->belongsTo(User::class);
+    }
+}

app/Models/ProviderProfile.php

@@ -2,6 +2,7 @@
 
 namespace App\Models;
 
+use App\Enums\VerificationStatus;
 use Illuminate\Database\Eloquent\Model;
 
 /**
@@ -23,7 +24,9 @@ use Illuminate\Database\Eloquent\Model;
  *     @OA\Property(property="certifications", type="string", example="PADI五星級潛水中心,SSI認證中心", description="業者相關認證"),
  *     @OA\Property(property="facilities", type="string", example="空氣填充站,沖洗區,更衣室,休息區", description="設施"),
  *     @OA\Property(property="business_hours", type="string", example="週一至週五 09:00-18:00，週六日 08:00-19:00", description="營業時間"),
- *     @OA\Property(property="is_verified", type="boolean", example=true, description="是否通過平台驗證"),
+ *     @OA\Property(property="verification_status", type="string", example="approved", description="審核狀態：unsubmitted / pending / approved / rejected"),
+ *     @OA\Property(property="rejection_reason", type="string", nullable=true, example=null, description="駁回原因（rejected 時有值）"),
+ *     @OA\Property(property="is_verified", type="boolean", example=true, description="是否通過平台驗證（相容欄位，= verification_status 為 approved）"),
  *     @OA\Property(property="rating", type="number", format="float", example=4.8, description="評分"),
  *     @OA\Property(property="website", type="string", example="https://www.bluedive.com", description="官方網站"),
  *     @OA\Property(property="social_media", type="string", example="https://www.facebook.com/bluedive", description="社群媒體連結"),
@@ -55,7 +58,8 @@ class ProviderProfile extends Model
         'certifications',
         'facilities',
         'business_hours',
-        'is_verified',
+        'verification_status',
+        'rejection_reason',
         'rating',
         'website',
         'social_media',
@@ -64,6 +68,21 @@ class ProviderProfile extends Model
         'is_active'
     ];
 
+    protected $casts = [
+        'verification_status' => VerificationStatus::class,
+    ];
+
+    /**
+     * API 相容層：既有前端與 Swagger 讀取 is_verified boolean，
+     * 欄位移除後以 accessor 維持輸出（= 審核通過）
+     */
+    protected $appends = ['is_verified'];
+
+    public function getIsVerifiedAttribute(): bool
+    {
+        return $this->verification_status === VerificationStatus::Approved;
+    }
+
     /**
      * 與用戶的關聯
      */

app/Models/User.php

@@ -140,6 +140,14 @@ class User extends Authenticatable
         return $this->hasOne(ProviderProfile::class);
     }
 
+    /**
+     * 教練驗證證照圖片（送審用）
+     */
+    public function providerCertifications()
+    {
+        return $this->hasMany(ProviderCertification::class);
+    }
+
     /**
      * 獲取用戶的會員資料
      */