feat(root): wire course/module/activity routes into the Platform API

course-routes.js — student-facing: the full course tree through an
enrollment (GET /api/student/programs/:id/courses) and the lesson
completion marker (POST /api/student/activities/:id/complete, refused
for anything but a manual_marker activity — a lab/assessment can never
be faked complete through this route).

admin-course-routes.js — instructor-facing, read-only (no WYSIWYG CMS
this phase): program structure with instructor notes
(GET /api/admin/programs/:id/courses) and per-student progress
(GET /api/admin/students/:id/courses), scoped via
requireStudentRelationshipAccess — the same self-paced-no-cohort rule
Phase 5C's notification routes already established, not
requireStudentCohortAccess (which would 403 a plain instructor out of
every self-paced student).

Dockerfile now also COPYs content/ alongside the existing scenarios/ —
same 'read-only, never executed' reasoning as that line.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

platform/api/Dockerfile

@@ -33,6 +33,10 @@ COPY platform/api/migrate-sqlite.js ./
 # listing/progress-shaping (never executed; setup/validate/teardown stay Lab-only).
 COPY scenarios/ ./scenarios/
 
+# Phase 6A — course/module lesson prose (content.js). Git-tracked Markdown, read-only, same
+# reasoning as scenarios/ above: this image only ever reads it, never executes anything from it.
+COPY content/ ./content/
+
 # Platform-shell + admin frontend, built in the stage above — served statically, no nginx
 # needed for a lightweight Node API+static server.
 COPY --from=frontend-build /fe/dist/ /frontend-dist/