feat: resolve Phase 1 contract requests and compose every feature

Contracts and core:
- Feature gains auth and stop; FeatureFactory; core composeServer builds the
  context, runs the factories, then the job queue from the union of their jobs
  (R8/R14). startServer uses it; main.ts composes learner, import, studio, AI.
- AppConfig/loadConfig own the layout and settings: courseDirs include
  <dataDir>/courses and <dataDir>/worktrees, studioReposDir, cacheDir,
  importRoots, uploadMaxMb, aiAllowedBaseUrls, transcribeUrl, python.
  resolveConfig derives the same for tests; cachePaths shares the importer's
  cache layout.
- canView: the global author role views every course (R14); the learner,
  studio and AI packages all call it.
- migrate(db, packages): core first, then packages in name order.
- Media: nosniff on every response, a sandbox CSP on svg/html/js; a Range on
  an empty file is 416.
- courseUrl/lessonUrl and the lesson route patterns live in @stc/contracts.

Packages:
- import, studio and AI read AppConfig instead of process.env; the importer
  refuses ids used by studio/repos.
- learner migrations run through core migrate; library covers fall back to
  the importer's cached candidate behind a canView-checked route.
- studio preview renders through the learner LessonView (anchors honoured,
  draft URLs); AI drafts go to the studio draft branch for studio courses (as
  the requesting user) and to <dataDir>/drafts otherwise, and the generator
  page says which.

Web: tsconfig paths for @stc/<feature>/web browser entries; features.ts
imports them by package name; nav.roles hides links by role.

Tests: compose, config, canView, media headers, migrations order, covers,
preview, nav, SPA bundle without server code, and an end-to-end flow on
SQLite and Postgres.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/feature-learner/test/visibility.test.ts

@@ -3,12 +3,13 @@ import { forEachDb } from "./helpers";
 import { FIXTURES, makeApp } from "./app";
 import { extraCourses } from "./courses";
 
-forEachDb("one visibility rule: the global author role alone does not open a restricted course (I1)", async (db) => {
+forEachDb("one visibility rule (core canView, R14): owner, the global author role and per-course authors open a restricted course; learners do not", async (db) => {
   const dir = await extraCourses();
   const { call, signUp } = await makeApp(db, [FIXTURES, dir]);
   const owner = await signUp("owner@x.test");
   const author = await signUp("author@x.test");
   const coAuthor = await signUp("co@x.test");
+  const learner = await signUp("lea@x.test");
   const users = (await (await call("GET", "/api/admin/users", { cookie: owner })).json()) as { id: string; email: string }[];
   const id = (e: string) => users.find((u) => u.email === e)!.id;
   expect((await call("PUT", `/api/admin/users/${id("author@x.test")}/roles`, { cookie: owner, body: { roles: ["author"] } })).status).toBe(200);
@@ -16,12 +17,15 @@ forEachDb("one visibility rule: the global author role alone does not open a res
 
   const paths = ["/api/courses/secret", "/api/courses/secret/lessons/s1", "/api/media/secret/a.md"];
   for (const p of paths) {
-    expect([p, (await call("GET", p, { cookie: author })).status]).toEqual([p, 404]);
+    expect([p, (await call("GET", p, { cookie: author })).status]).toEqual([p, 200]);
     expect([p, (await call("GET", p, { cookie: coAuthor })).status]).toEqual([p, 200]);
+    expect([p, (await call("GET", p, { cookie: learner })).status]).toEqual([p, 404]);
+    expect([p, (await call("GET", p)).status]).toEqual([p, 404]);
   }
   const lib = async (c: string) => ((await (await call("GET", "/api/library", { cookie: c })).json()) as { courses: { id: string }[] }).courses.map((x) => x.id);
-  expect(await lib(author)).not.toContain("secret");
+  expect(await lib(author)).toContain("secret");
   expect(await lib(coAuthor)).toContain("secret");
-  const search = (await (await call("GET", "/api/library/search?q=hidden", { cookie: author })).json()) as unknown[];
+  expect(await lib(learner)).not.toContain("secret");
+  const search = (await (await call("GET", "/api/library/search?q=hidden", { cookie: learner })).json()) as unknown[];
   expect(search).toEqual([]);
 });