[iamharshtita]

What changed

Implements api.md section 7 (read-api) and authorizer-apikey:

• GET /read/cohorts, /cohorts/{id}/summary, /classes/{id}/summary, /modules/{id}/gain, /concepts/gain, /progress?groupBy=cohort|class|module|org&from=&to=.
• Aggregates only. Groups under 5 students return suppressed: true with null metrics. A test checks that responses never contain student names or IDs.
• authorizer-apikey: key format cic_<keyId>_<secret>, constant-time hash compare, scope and revocation checks, fails closed, 60 second cache, records lastUsedAt.
• CDK: ReadApi construct with read-only table access, API key authorizer, and per-route throttling (5 rps, burst 10). Writing a test for the throttle found that CfnStage.routeSettings needs PascalCase keys, which would have failed at deploy time.
• 10 new Python tests, 1 new CDK test.

Why

CIC's org dashboard needs cohort stats without a login.

How to test

cd backend && npm test && npm run test:py

For the admin API-key endpoint (section 2)

Key items must be KEY#<keyId> / META with secretHash (sha256 hex), scopes, label, createdBy, createdAt. The contract is in api.md section 7 and architecture.md section 6. Admin should also seed ORG#<id> and COH#<id> items with name.

Stacked on #8. Merge in order: #5, #6, #7, #8, this.

[github-actions]

👋 Quick PR hygiene check (nothing is blocked):

• 507 changed lines — PRs under 400 lines get reviewed and merged faster; consider splitting the next one.

Small PRs with short, clear descriptions are what judges and recruiters read. See AGENTS.md.