Hotfix: add student visibility preview

[sclibraries]

Summary

• add an authenticated Preview as student mode to public course pages
• enforce the same resource and link visibility rules across cards and combined/split tables
• hide out-of-window link metadata and visibility annotations from student output
• preserve staff visibility bypass and annotations outside preview mode
• make date-only visibility end dates inclusive through the local end of day
• preserve existing course, college, section, and other URL parameters when entering or leaving preview

Production isolation

This branch was created from the current production main commit, eacfc14d8fdff51030b989f6fd640c8357d44973.

The protected production and workflow paths are unchanged:

• .env.production
• .env.staging
• src/pages/Admin.jsx
• src/components/layout/AppRoutes.jsx
• src/components/layout/Header.jsx
• src/config/api.config.js
• server/workflow-admin

The existing direct-URL workflow exposure remains intentionally out of scope. A separate production-hardening issue still needs to be filed.

Verification

• npm test — 4 files, 16 tests passed
• targeted ESLint
• npm run build — 1,321 modules transformed
• git diff --check
• protected-file diff against production baseline
• independent whole-branch code review and scoped re-review

Non-failing existing warnings remain for React/Reactstrap defaultProps, stale Browserslist data, and the large production bundle.

Release gates

This PR is intentionally a draft and is not approved for deployment until all of the following are complete:

• run the logged-out, staff-default, and staff-preview=student browser matrix in a release-approved environment, covering card/table and combined/split views
• confirm out-of-window resources, primary links, additional links, and staff annotations match the expected matrix
• identify a redeployable rollback artifact and establish its mapping to the currently deployed production baseline
• file the separate issue to harden direct workflow URLs in production

Current live-production identification evidence recorded during review: ETag "e19-64b0a0134802e", JavaScript /course-reserves/assets/index-BVrqv7LB.js, and CSS /course-reserves/assets/index-BuUcupEY.css. These identifiers do not by themselves constitute a redeployable rollback artifact.

Rollback

No schema, API, authentication, or persistence changes are included. The source rollback baseline is production main at eacfc14d8fdff51030b989f6fd640c8357d44973; deployment must not proceed until the artifact-level rollback requirement above is satisfied.