feat: resolve Phase 1 contract requests and compose every feature

Contracts and core:
- Feature gains auth and stop; FeatureFactory; core composeServer builds the
  context, runs the factories, then the job queue from the union of their jobs
  (R8/R14). startServer uses it; main.ts composes learner, import, studio, AI.
- AppConfig/loadConfig own the layout and settings: courseDirs include
  <dataDir>/courses and <dataDir>/worktrees, studioReposDir, cacheDir,
  importRoots, uploadMaxMb, aiAllowedBaseUrls, transcribeUrl, python.
  resolveConfig derives the same for tests; cachePaths shares the importer's
  cache layout.
- canView: the global author role views every course (R14); the learner,
  studio and AI packages all call it.
- migrate(db, packages): core first, then packages in name order.
- Media: nosniff on every response, a sandbox CSP on svg/html/js; a Range on
  an empty file is 416.
- courseUrl/lessonUrl and the lesson route patterns live in @stc/contracts.

Packages:
- import, studio and AI read AppConfig instead of process.env; the importer
  refuses ids used by studio/repos.
- learner migrations run through core migrate; library covers fall back to
  the importer's cached candidate behind a canView-checked route.
- studio preview renders through the learner LessonView (anchors honoured,
  draft URLs); AI drafts go to the studio draft branch for studio courses (as
  the requesting user) and to <dataDir>/drafts otherwise, and the generator
  page says which.

Web: tsconfig paths for @stc/<feature>/web browser entries; features.ts
imports them by package name; nav.roles hides links by role.

Tests: compose, config, canView, media headers, migrations order, covers,
preview, nav, SPA bundle without server code, and an end-to-end flow on
SQLite and Postgres.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/feature-import/src/roots.ts

@@ -5,19 +5,17 @@ import type { Deps } from "./context";
 
 export const OUTSIDE = "path is outside the allowed import folders";
 
-/** STC_IMPORT_ROOTS (":"-separated), default <dataDir>/import-inbox. */
-export function importRoots(d: Pick<Deps, "ctx" | "env">): string[] {
-  const raw = d.env.STC_IMPORT_ROOTS;
-  const list = raw ? raw.split(":").filter(Boolean) : [resolve(d.ctx.config.dataDir, "import-inbox")];
-  return list.map((r) => resolve(r));
+/** AppConfig.importRoots: STC_IMPORT_ROOTS (":"-separated), default <dataDir>/import-inbox. */
+export function importRoots(d: Pick<Deps, "importRoots">): string[] {
+  return d.importRoots.map((r) => resolve(r));
 }
 
-export function ensureRoots(d: Pick<Deps, "ctx" | "env">): void {
+export function ensureRoots(d: Pick<Deps, "importRoots">): void {
   for (const r of importRoots(d)) { try { mkdirSync(r, { recursive: true }); } catch { /* reported when used */ } }
 }
 
 /** Real path (symlinks followed) must lie inside the real path of one root. Throws OUTSIDE otherwise. */
-export async function assertAllowedPath(d: Pick<Deps, "ctx" | "env">, path: string): Promise<string> {
+export async function assertAllowedPath(d: Pick<Deps, "importRoots">, path: string): Promise<string> {
   let real: string;
   try { real = await realpath(resolve(path)); } catch { throw new Error(OUTSIDE); }
   for (const root of importRoots(d)) {