feat(activation): wire notifications into enrollment/auth, real password-reset delivery

- integration-routes.js: accepts student.contact_email, calls notifyForEnrollment on a
  genuinely new enrollment only (never on an idempotent replay — inherits Phase 5B's proven
  enrollment-level idempotency, no separate notification dedup needed).
- admin-routes.js: create-student/convert/reset-password now enqueue the corresponding
  notification using the SAME token already minted synchronously (never mints twice, which
  would silently invalidate the token just handed back in the response). Fixed a real bug:
  request-password-reset would mint a reset token for a never-activated student, which makes
  no sense and would confuse them — now falls through to the generic anti-enumeration response.
- admin-programs-routes.js: manual enrollment triggers the same notification decision as the
  website path.
- student-auth-routes.js: /activate records a metric; /change-password and /reset-password
  both queue a password_changed security notice; /request-password-reset now actually delivers
  email (production still never returns the token — unchanged anti-enumeration/isProduction
  gating, just now with a real send behind it).
- rbac.js: requireStudentRelationshipAccess/checkStudentRelationshipAccess — the notification
  visibility rule (cohort-shared or an enrollment they created), reusable beyond just
  enrollments.
- server.js: wires notification-routes.js and starts the notification worker in main().
- docker-compose.dev.yml: PUBLIC_APP_ORIGIN, EMAIL_FROM_NAME, and a parametrized COOKIE_SECURE
  (was hard-commented-out; needed so e2e-phase5c.js can actually prove production gating).

platform/api/src/server.js

@@ -395,6 +395,14 @@ require('./admin-programs-routes')(app, {
 });
 require('./integration-routes')(app, { getPool, recordAudit, wrap });
 
+// Phase 5C — enrollment operations & communications. notification-routes.js is the
+// instructor/admin half (list, per-student view, resend-activation, send-enrollment-
+// confirmation); the actual delivery worker starts in main() below, alongside the existing
+// session/login-attempt sweepers — see docs/PHASE5C_ENROLLMENT_COMMUNICATIONS.md.
+require('./notification-routes')(app, {
+  instructorSession: wrap(instructorSession), rbac, getPool, recordAudit,
+});
+
 // Fallback to the platform-shell SPA for any unmatched non-API route
 app.get('*', (req, res) => {
   res.sendFile(path.join(FRONTEND_DIST, 'index.html'));
@@ -414,6 +422,10 @@ async function main() {
   if (applied.length) console.log('Applied migrations:', applied.join(', '));
   sessions.startSessionSweeper(getPool());
   startLoginAttemptSweeper(getPool()); // Phase 4.1 §15
+  const { startNotificationWorker } = require('./notification-worker');
+  const { EMAIL_PROVIDER } = require('./email/provider');
+  console.log(`[notification-worker] starting (EMAIL_PROVIDER=${EMAIL_PROVIDER})`);
+  startNotificationWorker(getPool()); // Phase 5C §14
   app.listen(PORT, () => console.log(`Platform API listening on :${PORT}`));
 }