feat: resolve Phase 1 contract requests and compose every feature

Contracts and core:
- Feature gains auth and stop; FeatureFactory; core composeServer builds the
  context, runs the factories, then the job queue from the union of their jobs
  (R8/R14). startServer uses it; main.ts composes learner, import, studio, AI.
- AppConfig/loadConfig own the layout and settings: courseDirs include
  <dataDir>/courses and <dataDir>/worktrees, studioReposDir, cacheDir,
  importRoots, uploadMaxMb, aiAllowedBaseUrls, transcribeUrl, python.
  resolveConfig derives the same for tests; cachePaths shares the importer's
  cache layout.
- canView: the global author role views every course (R14); the learner,
  studio and AI packages all call it.
- migrate(db, packages): core first, then packages in name order.
- Media: nosniff on every response, a sandbox CSP on svg/html/js; a Range on
  an empty file is 416.
- courseUrl/lessonUrl and the lesson route patterns live in @stc/contracts.

Packages:
- import, studio and AI read AppConfig instead of process.env; the importer
  refuses ids used by studio/repos.
- learner migrations run through core migrate; library covers fall back to
  the importer's cached candidate behind a canView-checked route.
- studio preview renders through the learner LessonView (anchors honoured,
  draft URLs); AI drafts go to the studio draft branch for studio courses (as
  the requesting user) and to <dataDir>/drafts otherwise, and the generator
  page says which.

Web: tsconfig paths for @stc/<feature>/web browser entries; features.ts
imports them by package name; nav.roles hides links by role.

Tests: compose, config, canView, media headers, migrations order, covers,
preview, nav, SPA bundle without server code, and an end-to-end flow on
SQLite and Postgres.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/feature-learner/test/app.ts

@@ -2,7 +2,7 @@ import { mkdtempSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
 import type { AppConfig, JobQueue, ServerContext } from "@stc/contracts";
-import { createApp } from "@stc/core";
+import { createApp, resolveConfig } from "@stc/core";
 import { createCourseRepository } from "@stc/course-format";
 import type { Db } from "@stc/db";
 import { learnerFeature } from "../src/server/feature";
@@ -13,10 +13,10 @@ export const ORIGIN = "http://localhost:3000";
 const fakeJobs: JobQueue = { enqueue: async () => "j", get: async () => null, list: async () => [] };
 
 export async function makeApp(db: Db, courseDirs: string[] = [FIXTURES]) {
-  const config: AppConfig = {
+  const config: AppConfig = resolveConfig({
     port: 0, databaseUrl: "", dataDir: mkdtempSync(join(tmpdir(), "stc-learner-")), courseDirs,
     secret: "test-secret-0123456789abcdef0123456789", publicUrl: ORIGIN,
-  };
+  });
   const ctx: ServerContext = {
     config, db, courses: await createCourseRepository(courseDirs), jobs: fakeJobs,
     auth: { userFromRequest: async () => null },

packages/feature-learner/test/covers.test.ts

@@ -0,0 +1,40 @@
+import { expect } from "bun:test";
+import { join } from "node:path";
+import { forEachDb } from "./helpers";
+import { FIXTURES, makeApp } from "./app";
+import { extraCourses } from "./courses";
+
+const JPEG = new Uint8Array([0xff, 0xd8, 0xff, 0xe0, 0, 0x10, 0x4a, 0x46, 0x49, 0x46, 0, 1, 0xff, 0xd9]);
+
+forEachDb("the library falls back to the importer's cover candidate, served only to users who can view the course", async (db) => {
+  const dir = await extraCourses();
+  const { call, signUp, ctx } = await makeApp(db, [FIXTURES, dir]);
+  const covers = (id: string) => join(ctx.config.cacheDir, "covers", id);
+  await Bun.write(join(covers("sample"), "deck-d1.jpg"), JPEG);
+  await Bun.write(join(covers("sample"), "frame-2.jpg"), JPEG);
+  await Bun.write(join(covers("sample"), "frame-10.jpg"), new Uint8Array([1]));
+  await Bun.write(join(covers("secret"), "frame-1.jpg"), JPEG);
+  await Bun.write(join(covers("sample"), "notes.txt"), "not a cover");
+
+  const lib = async (cookie?: string) => ((await (await call("GET", "/api/library", { cookie })).json()) as { courses: { id: string; coverUrl: string | null }[] }).courses;
+  const sample = (await lib()).find((c) => c.id === "sample")!;
+  expect(sample.coverUrl).toBe("/api/courses/sample/cover");
+  const r = await call("GET", "/api/courses/sample/cover");
+  expect(r.status).toBe(200);
+  expect(r.headers.get("content-type")).toBe("image/jpeg");
+  expect(r.headers.get("x-content-type-options")).toBe("nosniff");
+  expect(new Uint8Array(await r.arrayBuffer())).toEqual(JPEG); // frame-2 (frames first, numeric order), not frame-10 or the deck
+  expect((await (await call("GET", "/api/courses/sample")).json()).coverUrl).toBe("/api/courses/sample/cover");
+
+  // restricted: 404 for anonymous users and learners without access, 200 for the owner
+  const owner = await signUp("owner@x.test");
+  const learner = await signUp("lea@x.test");
+  expect((await call("GET", "/api/courses/secret/cover")).status).toBe(404);
+  expect((await call("GET", "/api/courses/secret/cover", { cookie: learner })).status).toBe(404);
+  expect((await call("GET", "/api/courses/secret/cover", { cookie: owner })).status).toBe(200);
+  expect((await lib(owner)).find((c) => c.id === "secret")!.coverUrl).toBe("/api/courses/secret/cover");
+  // no candidate: no cover, and the route is 404
+  expect((await lib(owner)).find((c) => c.id === "gated")!.coverUrl).toBeNull();
+  expect((await call("GET", "/api/courses/gated/cover", { cookie: owner })).status).toBe(404);
+  expect((await call("GET", "/api/courses/..%2Fsample/cover", { cookie: owner })).status).toBe(404);
+});

packages/feature-learner/test/visibility.test.ts

@@ -3,12 +3,13 @@ import { forEachDb } from "./helpers";
 import { FIXTURES, makeApp } from "./app";
 import { extraCourses } from "./courses";
 
-forEachDb("one visibility rule: the global author role alone does not open a restricted course (I1)", async (db) => {
+forEachDb("one visibility rule (core canView, R14): owner, the global author role and per-course authors open a restricted course; learners do not", async (db) => {
   const dir = await extraCourses();
   const { call, signUp } = await makeApp(db, [FIXTURES, dir]);
   const owner = await signUp("owner@x.test");
   const author = await signUp("author@x.test");
   const coAuthor = await signUp("co@x.test");
+  const learner = await signUp("lea@x.test");
   const users = (await (await call("GET", "/api/admin/users", { cookie: owner })).json()) as { id: string; email: string }[];
   const id = (e: string) => users.find((u) => u.email === e)!.id;
   expect((await call("PUT", `/api/admin/users/${id("author@x.test")}/roles`, { cookie: owner, body: { roles: ["author"] } })).status).toBe(200);
@@ -16,12 +17,15 @@ forEachDb("one visibility rule: the global author role alone does not open a res
 
   const paths = ["/api/courses/secret", "/api/courses/secret/lessons/s1", "/api/media/secret/a.md"];
   for (const p of paths) {
-    expect([p, (await call("GET", p, { cookie: author })).status]).toEqual([p, 404]);
+    expect([p, (await call("GET", p, { cookie: author })).status]).toEqual([p, 200]);
     expect([p, (await call("GET", p, { cookie: coAuthor })).status]).toEqual([p, 200]);
+    expect([p, (await call("GET", p, { cookie: learner })).status]).toEqual([p, 404]);
+    expect([p, (await call("GET", p)).status]).toEqual([p, 404]);
   }
   const lib = async (c: string) => ((await (await call("GET", "/api/library", { cookie: c })).json()) as { courses: { id: string }[] }).courses.map((x) => x.id);
-  expect(await lib(author)).not.toContain("secret");
+  expect(await lib(author)).toContain("secret");
   expect(await lib(coAuthor)).toContain("secret");
-  const search = (await (await call("GET", "/api/library/search?q=hidden", { cookie: author })).json()) as unknown[];
+  expect(await lib(learner)).not.toContain("secret");
+  const search = (await (await call("GET", "/api/library/search?q=hidden", { cookie: learner })).json()) as unknown[];
   expect(search).toEqual([]);
 });