[iamharshtita]

What changed

Implements api.md section 6 (student-api Lambda) plus authorizer-student:

• GET /student/home: module states and the resume pointer. Late joiners start at their start module, earlier modules show catch_up.
• GET /student/modules/{id}: module with answer keys and explanations stripped. Locked modules return 403 MODULE_LOCKED.
• POST .../submit: server-side grading, ordered activities (ACTIVITY_LOCKED), pre and post tests recorded once with no feedback, clientSubmissionId replay, worksheets split into auto-scored and review-queue fields.
• POST .../heartbeat (capped at 45s credit), PUT .../draft, POST .../complete (minimum time for video).
• authorizer-student: resolves SES#<sha256(token)> to studentId and classId. Denies expired sessions, reset credentials (credVersion mismatch) and inactive students. Fails closed. 60 second cache.
• CDK: StudentPlayerApi construct (least-privilege grants, no wildcards), authorizer wiring, and a test that Python and CDK route keys match.
• 15 new Python tests using moto (real DynamoDB expressions) and 3 new CDK tests.

Why

This is the core of the Sunday demo: a student works through a module alone and the next one unlocks.

How to test

cd backend && pip install -r requirements-dev.txt && npm test && npm run test:py

Notes for the login endpoint (section 1)

The session item contract is now in architecture.md section 6: SES#<sha256(token)> with studentId, classId, credVersion, ttl.

Stacked on #6. Merge #5, then #6, then this.

[github-actions]

👋 Quick PR hygiene check (nothing is blocked):

• 805 changed lines — PRs under 400 lines get reviewed and merged faster; consider splitting the next one.

Small PRs with short, clear descriptions are what judges and recruiters read. See AGENTS.md.