Fix watch tracking, video unlocking and access-control gaps

Watch progress and unlocking:
- Player samples the playhead and reports the ranges actually played,
  so skipped sections earn no credit and early plays are not lost
- Server merges ranges into compact segment rows; progress never regresses
- Single 80% unlock rule enforced server-side (lib/watch-progress.ts);
  the Unlock button and automatic unlock now agree
- Lock state and progress bar update live from each progress save
- Playlist is derived from the video, so unlocks work for shared
  playlists and for links from watch history and liked videos
- First/previous video decided by playlist position, not index numbers

Access control:
- Video API and HLS/MP4 routes require a signed-in viewer who is
  enrolled and has the video unlocked; thumbnails require sign-in
- Enrolment sync reads course codes from the allow-list, not the request
- /api/admin/meta is admin-only
- Account status, role and levels are re-checked from the database
  during a session, so deactivated students lose access within a minute

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>

app/api/admin/meta/route.ts

@@ -1,13 +1,12 @@
 // app/api/admin/meta/route.ts
 import { NextResponse } from 'next/server';
 import { prisma } from '@/lib/prisma';
-import { getServerSession } from 'next-auth';
-import { authOptions } from '@/lib/auth-options';
+import { adminGuard } from '@/lib/admin-check';
 
 export async function GET() {
-  // Basic protection: ensure signed-in user is admin. Modify as needed.
-  // If you want stricter, get session from context or check roles.
-  // Here we skip session check to let dev access; but production should check.
+  const denied = await adminGuard();
+  if (denied) return denied;
+
   try {
     const courses = await prisma.course.findMany({ orderBy: { title: 'asc' } });
     const playlists = await prisma.playlist.findMany({ orderBy: { title: 'asc' } });