Verified purchase badge distinguishes buyer reviews from non-buyer reviews

The FTC Endorsement Guides (revised 2023) explicitly require that "Verified Purchase" or equivalent indicators be truthful — displaying the badge for reviews from non-buyers is a deceptive endorsement. Beyond legal risk, unverified reviews mixed into the same display as genuine buyer reviews dilute trust: a product with 100% "Verified Purchase" badges where the badge is just hardcoded to true will have the label completely reverse-fired when a single fraudulent review is exposed publicly. The verified_purchase check must reach into order history at submission time to have any meaning; a database field alone without that query is cosmetic.

Check order history at review submission time in api/reviews/submit and expose the badge in components/ReviewItem.tsx.

ALTER TABLE reviews ADD COLUMN verified_purchase BOOLEAN NOT NULL DEFAULT FALSE;

// api/reviews/submit
const purchase = await db.orders.findFirst({
  where: { user_id: userId, product_id: productId, status: 'completed' }
})

await db.reviews.create({
  data: {
    verified_purchase: purchase !== null,
    // ...
  }
})

// components/ReviewItem.tsx
{review.verified_purchase && (
  <span className="badge-verified" aria-label="Verified Purchase">
    ✓ Verified Purchase
  </span>
)}

Never set verified_purchase: true on insert without the order lookup — the badge only has legal standing if it reflects an actual completed transaction.