[iamharshtita]

What changed

Implements api.md section 5 (reports-api Lambda):

• GET /classes/{id}/progress, /students/{id}/progress, /attention (not started and stuck, with reasons), /modules/{id}/gain, /concepts (gain plus mastery), /review-queue, PUT .../submissions/{id}/review, /export (CSV), and GET /admin/cohorts/{id}/summary (admin only).
• Authorization: admins for any class, instructors only for classes they belong to, reviewers never. A review cannot touch another class's submission.
• CSV export neutralizes formula injection and writes an audit entry.
• Shared layer additions: classdata (loaders), summaries (class and cohort rollups, reused by the read API), audit, csvutil, and a raw-body reply type in http.
• CDK: ReportsApi construct on the Cognito JWT authorizer; read-only on content and core, write on progress (reviews) and events (audit).
• 10 new Python tests (moto) and 2 new CDK tests. Python route keys and CDK route keys are checked against each other.

Why

Instructors need to see who is stuck, and funders need learning gain by concept and class.

How to test

cd backend && npm test && npm run test:py

For the roster and class endpoints (section 4)

These reports read: class META with name, cohortId, gsi2pk=COH#<id>, gsi2sk=CLS#<id>; roster items with rosterNumber, displayName, status, createdAt, optional startModuleId; assignments with moduleVersion and createdAt; OVR# items with studentId and moduleId.

Stacked on #7. Merge in order: #5, #6, #7, this.

[github-actions]

👋 Quick PR hygiene check (nothing is blocked):

• 825 changed lines — PRs under 400 lines get reviewed and merged faster; consider splitting the next one.

Small PRs with short, clear descriptions are what judges and recruiters read. See AGENTS.md.