Add prospective classroom work and shared playback controls

[zmuhls]

New work explicitly assigned to a course can be reviewed by that course's current instructor and shared through private or course-scoped folders. Existing personal work and transcripts stay private; there is no historical backfill. Stem consumes the private course contract from Portal draft https://github.com/CUNY-AI-Lab/cail-tools-admission/pull/295, verifies current exact-course authority, and preserves separate app administrative permissions.

Adds durable paginated course conversations with reset and interrupted-turn fencing, attributed annotations, revisioned course prompts, and a maintenance pause. The additive local migration preserves existing records. The compact interface includes course/roster/folder views, consistent controls and casing, account-switch clearing, and Refresh that preserves playback and unsaved notes.

Every track waveform now has a named native range input using the existing shared seek lifecycle. Pointer, touch and keyboard actions preserve synchronized stems, playback state and rate. Account rechecks hide private views until verified; prompt and classroom requests bind reads/writes to the selected course generation, including failed and rapid switches.

Validation at final head f5506597f8fab2196d3f55119242d76210ff553d (application code 1f7e0205a4130bd46cf2180772671e57cc9387fe): 321 shared tests, 42 server tests, 50 Cloudflare tests, 36 Chrome scenarios, and 19 local-hosting scenarios passed locally. Firefox and WebKit each passed 25 classroom/playback/shared-audio scenarios, with only the native-Chromium zoom case skipped. An additional actual native 200% Chromium check passed waveform pointer/keyboard seeking with two synchronized stems and annotation controls. Local migration preservation, typechecks and dry build passed. Final test-only changes make the schema fixture work in shallow checkouts, install the Chromium runtime used by the native zoom check, and explicitly distinguish the current chat reply from the archived reply. See docs/acceptance/classroom-2026-10-06.md and docs/classroom-access.md for evidence and limits.

Review and CI: independent review passed the exact final head f550659, closing all backend and UI findings, with original negative probes, 7 targeted browser and 13 backend cases plus review of the final test-only changes. All remote checks are green on that same head: Source and native analysis image, Cloudflare Worker/browser/bundle checks. Guest 5/25 allowances, redacted usage events and durable recovery belong to stacked draft #29, keeping the total at three PRs across the two repositories.

Release hold: no production migration or deployment is authorized. External Stem deployment triggers remain unverified; do not merge while that could cause an unapproved deployment. Missing Admission methods fail closed. Receiver enforcement must precede exposing the Portal destination. Live CUNY MFA, real instructor/student workflows and paid-provider acceptance remain unverified. Railway and its data/configuration are untouched.