feat: resolve Phase 1 contract requests and compose every feature

Contracts and core:
- Feature gains auth and stop; FeatureFactory; core composeServer builds the
  context, runs the factories, then the job queue from the union of their jobs
  (R8/R14). startServer uses it; main.ts composes learner, import, studio, AI.
- AppConfig/loadConfig own the layout and settings: courseDirs include
  <dataDir>/courses and <dataDir>/worktrees, studioReposDir, cacheDir,
  importRoots, uploadMaxMb, aiAllowedBaseUrls, transcribeUrl, python.
  resolveConfig derives the same for tests; cachePaths shares the importer's
  cache layout.
- canView: the global author role views every course (R14); the learner,
  studio and AI packages all call it.
- migrate(db, packages): core first, then packages in name order.
- Media: nosniff on every response, a sandbox CSP on svg/html/js; a Range on
  an empty file is 416.
- courseUrl/lessonUrl and the lesson route patterns live in @stc/contracts.

Packages:
- import, studio and AI read AppConfig instead of process.env; the importer
  refuses ids used by studio/repos.
- learner migrations run through core migrate; library covers fall back to
  the importer's cached candidate behind a canView-checked route.
- studio preview renders through the learner LessonView (anchors honoured,
  draft URLs); AI drafts go to the studio draft branch for studio courses (as
  the requesting user) and to <dataDir>/drafts otherwise, and the generator
  page says which.

Web: tsconfig paths for @stc/<feature>/web browser entries; features.ts
imports them by package name; nav.roles hides links by role.

Tests: compose, config, canView, media headers, migrations order, covers,
preview, nav, SPA bundle without server code, and an end-to-end flow on
SQLite and Postgres.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/db/src/index.ts

@@ -1,5 +1,5 @@
 export { connect, type Db } from "./connect";
-export { migrate } from "./migrate";
+export { migrate, type PackageMigrations } from "./migrate";
 export { progressRepo, type LessonProgress, type ProgressState } from "./repos/progress";
 export { notesRepo, type Note, type NoteInput } from "./repos/notes";
 export { attemptsRepo, type Attempt } from "./repos/attempts";

packages/db/src/migrate.ts

@@ -9,19 +9,34 @@ function statements(text: string): string[] {
   return noComments.split(";").map((s) => s.trim()).filter(Boolean);
 }
 
-export async function migrate(db: Db): Promise<string[]> {
+/** Migration folders contributed by feature packages, keyed by package name. */
+export type PackageMigrations = Record<string, string[]>;
+
+/**
+ * Applies pending migrations: core (`packages/db/migrations`) first, then each package's folders in alphabetical
+ * order of package name, files in name order within a folder. `schema_migrations` is keyed by file name, so file
+ * names must be unique across packages (each package prefixes its files, e.g. `0001_learner_auth.sql`).
+ */
+export async function migrate(db: Db, packages: PackageMigrations = {}): Promise<string[]> {
   await db.sql.unsafe("CREATE TABLE IF NOT EXISTS schema_migrations (name TEXT PRIMARY KEY, applied_at TEXT NOT NULL)");
   const done = new Set((await db.sql`SELECT name FROM schema_migrations`).map((r: { name: string }) => r.name));
-  const files = readdirSync(MIGRATIONS_DIR).filter((f) => f.endsWith(".sql")).sort();
+  const dirs = [MIGRATIONS_DIR, ...Object.keys(packages).sort().flatMap((k) => packages[k]!)];
+  const seen = new Map<string, string>();
   const applied: string[] = [];
-  for (const name of files) {
-    if (done.has(name)) continue;
-    const stmts = statements(readFileSync(join(MIGRATIONS_DIR, name), "utf8"));
-    await db.sql.begin(async (tx) => {
-      for (const s of stmts) await tx.unsafe(s);
-      await tx`INSERT INTO schema_migrations (name, applied_at) VALUES (${name}, ${new Date().toISOString()})`;
-    });
-    applied.push(name);
+  for (const dir of dirs) {
+    for (const name of readdirSync(dir).filter((f) => f.endsWith(".sql")).sort()) {
+      const other = seen.get(name);
+      if (other && other !== dir) throw new Error(`migration ${name} exists in both ${other} and ${dir}`);
+      seen.set(name, dir);
+      if (done.has(name)) continue;
+      const stmts = statements(readFileSync(join(dir, name), "utf8"));
+      await db.sql.begin(async (tx) => {
+        for (const s of stmts) await tx.unsafe(s);
+        await tx`INSERT INTO schema_migrations (name, applied_at) VALUES (${name}, ${new Date().toISOString()})`;
+      });
+      done.add(name);
+      applied.push(name);
+    }
   }
   return applied;
 }