feat: resolve Phase 1 contract requests and compose every feature

Contracts and core:
- Feature gains auth and stop; FeatureFactory; core composeServer builds the
  context, runs the factories, then the job queue from the union of their jobs
  (R8/R14). startServer uses it; main.ts composes learner, import, studio, AI.
- AppConfig/loadConfig own the layout and settings: courseDirs include
  <dataDir>/courses and <dataDir>/worktrees, studioReposDir, cacheDir,
  importRoots, uploadMaxMb, aiAllowedBaseUrls, transcribeUrl, python.
  resolveConfig derives the same for tests; cachePaths shares the importer's
  cache layout.
- canView: the global author role views every course (R14); the learner,
  studio and AI packages all call it.
- migrate(db, packages): core first, then packages in name order.
- Media: nosniff on every response, a sandbox CSP on svg/html/js; a Range on
  an empty file is 416.
- courseUrl/lessonUrl and the lesson route patterns live in @stc/contracts.

Packages:
- import, studio and AI read AppConfig instead of process.env; the importer
  refuses ids used by studio/repos.
- learner migrations run through core migrate; library covers fall back to
  the importer's cached candidate behind a canView-checked route.
- studio preview renders through the learner LessonView (anchors honoured,
  draft URLs); AI drafts go to the studio draft branch for studio courses (as
  the requesting user) and to <dataDir>/drafts otherwise, and the generator
  page says which.

Web: tsconfig paths for @stc/<feature>/web browser entries; features.ts
imports them by package name; nav.roles hides links by role.

Tests: compose, config, canView, media headers, migrations order, covers,
preview, nav, SPA bundle without server code, and an end-to-end flow on
SQLite and Postgres.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/feature-studio/test/app-helpers.ts

@@ -1,6 +1,6 @@
 import { resolve } from "node:path";
-import type { AuthUser, ServerContext } from "@stc/contracts";
-import { createApp } from "@stc/core";
+import type { AppConfig, AuthUser, ServerContext } from "@stc/contracts";
+import { createApp, resolveConfig } from "@stc/core";
 import { createCourseRepository } from "@stc/course-format";
 import { connect, migrate } from "@stc/db";
 import { studioFeature } from "../src/server/feature";
@@ -15,7 +15,7 @@ export const users: Record<string, AuthUser> = {
 };
 
 /** A server context like main.ts builds, with header-selected users (`x-user: ada`). */
-export async function setupApp(extraCourseDirs: string[] = [], dbUrl = "sqlite://:memory:", prepare?: (dataDir: string) => void) {
+export async function setupApp(extraCourseDirs: string[] = [], dbUrl = "sqlite://:memory:", prepare?: (dataDir: string) => void, configOverrides: Partial<AppConfig> = {}) {
   const dataDir = tempDir();
   prepare?.(dataDir);
   let dropSchema = async () => {};
@@ -31,7 +31,7 @@ export async function setupApp(extraCourseDirs: string[] = [], dbUrl = "sqlite:/
   }
   const db = await connect(dbUrl);
   await migrate(db);
-  const config = { port: 0, databaseUrl: "sqlite://:memory:", dataDir, courseDirs: extraCourseDirs, secret: "t", publicUrl: "http://x" };
+  const config = resolveConfig({ port: 0, databaseUrl: "sqlite://:memory:", dataDir, courseDirs: extraCourseDirs, secret: "t", publicUrl: "http://x", ...configOverrides });
   const courses = await createCourseRepository(studioCourseDirs(config));
   const ctx = {
     config, db, courses, jobs: null as never,

packages/feature-studio/test/preview.test.tsx

@@ -0,0 +1,28 @@
+import { expect, test } from "bun:test";
+import { renderToString } from "react-dom/server";
+import LearnerLessonPreview from "../src/ui/learnerPreview";
+
+const md = "# Intro\n\nHello ![pic](img/a.png)\n\n## Part two\n\nOnly this <b>part</b>.\n\n## Part three\n\nNot this.\n";
+const draft = (rel: string) => `/api/studio/courses/c1/raw/${rel}`;
+
+test("the studio preview renders through the learner LessonView, with draft URLs", () => {
+  const html = renderToString(<LearnerLessonPreview courseId="c1" markdown={md} lesson={{ id: "l1", title: "Lesson one", type: "text" }} file="lessons/one.md" resolveCourseUrl={draft} resolveUrl={() => "/wrong"} />);
+  expect(html).toContain('class="lr lr-lesson"');
+  expect(html).toContain("Lesson one");
+  expect(html).toContain('src="/api/studio/courses/c1/raw/lessons/img/a.png"');
+  expect(html).not.toContain("/api/media/");
+});
+
+test("an anchored lesson previews only its section; a missing anchor says so", () => {
+  const one = renderToString(<LearnerLessonPreview courseId="c1" markdown={md} lesson={{ id: "l1", title: "T", type: "text", anchor: "part-two" }} file="lessons/one.md" resolveCourseUrl={draft} resolveUrl={draft} />);
+  expect(one).toContain("Only this");
+  expect(one).not.toContain("Not this");
+  const missing = renderToString(<LearnerLessonPreview courseId="c1" markdown={md} lesson={{ id: "l1", title: "T", type: "text", anchor: "nope" }} file="lessons/one.md" resolveCourseUrl={draft} resolveUrl={draft} />);
+  expect(missing).toContain("was not found");
+});
+
+test("raw HTML in a draft is sanitised by the learner pipeline", () => {
+  const html = renderToString(<LearnerLessonPreview courseId="c1" markdown={"# T\n\n<img src=x onerror=alert(1)><script>alert(2)</script>"} lesson={{ id: "l1", title: "T", type: "text" }} file="a.md" resolveCourseUrl={draft} resolveUrl={draft} />);
+  expect(html).not.toContain("onerror");
+  expect(html).not.toContain("<script>");
+});

packages/feature-studio/test/security.test.ts

@@ -169,7 +169,7 @@ describe("I3: owner-only visibility", () => {
 
 describe("I2: uploads", () => {
   let env: Awaited<ReturnType<typeof setupApp>>;
-  afterEach(() => { delete process.env.STC_UPLOAD_MAX_MB; return env?.stop(); });
+  afterEach(() => env?.stop());
   const upload = (name: string, bytes: Uint8Array<ArrayBuffer>, extra: Record<string, string> = {}) => {
     const fd = new FormData();
     fd.set("file", new File([bytes], name));
@@ -192,10 +192,9 @@ describe("I2: uploads", () => {
     expect(readFileSync(join(env.dataDir, "worktrees/c1/drafts/u-ada/media/slides.pdf"))[0]).toBe(2);
   });
 
-  test("size cap from STC_UPLOAD_MAX_MB, by Content-Length and while streaming", async () => {
-    env = await setupApp();
+  test("size cap from AppConfig.uploadMaxMb (STC_UPLOAD_MAX_MB), by Content-Length and while streaming", async () => {
+    env = await setupApp([], "sqlite://:memory:", undefined, { uploadMaxMb: 1 });
     await env.call("ada", "POST", "/api/studio/courses", { id: "c1", title: "C" });
-    process.env.STC_UPLOAD_MAX_MB = "1";
     expect((await upload("big.zip", new Uint8Array(1024 * 1024 + 10))).status).toBe(413);
     // no Content-Length: a streamed body is cut off once it passes the cap
     const fd = new FormData();