feat(root): wire course/module/activity routes into the Platform API

course-routes.js — student-facing: the full course tree through an
enrollment (GET /api/student/programs/:id/courses) and the lesson
completion marker (POST /api/student/activities/:id/complete, refused
for anything but a manual_marker activity — a lab/assessment can never
be faked complete through this route).

admin-course-routes.js — instructor-facing, read-only (no WYSIWYG CMS
this phase): program structure with instructor notes
(GET /api/admin/programs/:id/courses) and per-student progress
(GET /api/admin/students/:id/courses), scoped via
requireStudentRelationshipAccess — the same self-paced-no-cohort rule
Phase 5C's notification routes already established, not
requireStudentCohortAccess (which would 403 a plain instructor out of
every self-paced student).

Dockerfile now also COPYs content/ alongside the existing scenarios/ —
same 'read-only, never executed' reasoning as that line.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

platform/api/src/server.js

@@ -395,6 +395,16 @@ require('./admin-programs-routes')(app, {
 });
 require('./integration-routes')(app, { getPool, recordAudit, wrap });
 
+// Phase 6A — course/module/activity content model, layered on top of the existing
+// scenario/assessment/achievement systems (never a duplicate of them — see
+// docs/COURSE_CONTENT_MODEL.md). course-routes.js is the student-facing half (course tree
+// through an enrollment, lesson completion marker); admin-course-routes.js is the instructor
+// curriculum view (structure + per-student progress).
+require('./course-routes')(app, { studentSession, getPool, wrap });
+require('./admin-course-routes')(app, {
+  instructorSession: wrap(instructorSession), rbac, getPool,
+});
+
 // Phase 5C — enrollment operations & communications. notification-routes.js is the
 // instructor/admin half (list, per-student view, resend-activation, send-enrollment-
 // confirmation); the actual delivery worker starts in main() below, alongside the existing