Fix watch tracking, video unlocking and access-control gaps

Watch progress and unlocking:
- Player samples the playhead and reports the ranges actually played,
  so skipped sections earn no credit and early plays are not lost
- Server merges ranges into compact segment rows; progress never regresses
- Single 80% unlock rule enforced server-side (lib/watch-progress.ts);
  the Unlock button and automatic unlock now agree
- Lock state and progress bar update live from each progress save
- Playlist is derived from the video, so unlocks work for shared
  playlists and for links from watch history and liked videos
- First/previous video decided by playlist position, not index numbers

Access control:
- Video API and HLS/MP4 routes require a signed-in viewer who is
  enrolled and has the video unlocked; thumbnails require sign-in
- Enrolment sync reads course codes from the allow-list, not the request
- /api/admin/meta is admin-only
- Account status, role and levels are re-checked from the database
  during a session, so deactivated students lose access within a minute

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>

app/api/thumbnails/[...path]/route.ts

@@ -4,6 +4,7 @@
 import { NextResponse } from 'next/server';
 import * as fs from 'fs';
 import * as path from 'path';
+import { getViewer } from '@/lib/video-access';
 
 // Path to thumbnails directory (should match UPLOADS_DIR/thumbnails)
 const THUMBNAILS_DIR = path.join(process.env.UPLOADS_DIR || '/uploads', 'thumbnails');
@@ -23,6 +24,11 @@ export async function GET(
       );
     }
 
+    // Thumbnails show course content, so they need a signed-in user.
+    if (!(await getViewer())) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 });
+    }
+
     // Construct the file path and validate it
     const requestedPath = path.join(THUMBNAILS_DIR, ...pathSegments);
     
@@ -44,7 +50,7 @@ export async function GET(
     }
 
     // Read the file
-    const fileContent = fs.readFileSync(requestedPath);
+    const fileContent = await fs.promises.readFile(requestedPath);
 
     // Determine content type based on file extension
     let contentType = 'application/octet-stream';
@@ -64,8 +70,7 @@ export async function GET(
       status: 200,
       headers: {
         'Content-Type': contentType,
-        'Cache-Control': 'public, max-age=31536000, immutable', // Cache for 1 year (thumbnails don't change)
-        'Access-Control-Allow-Origin': '*', // Allow CORS if needed
+        'Cache-Control': 'private, max-age=31536000, immutable', // Cache for 1 year (thumbnails don't change)
       },
     });
   } catch (error) {
@@ -90,6 +95,8 @@ export async function HEAD(
       return new NextResponse(null, { status: 400 });
     }
 
+    if (!(await getViewer())) return new NextResponse(null, { status: 401 });
+
     const requestedPath = path.join(THUMBNAILS_DIR, ...pathSegments);
     
     // Security: prevent directory traversal attacks
@@ -107,7 +114,7 @@ export async function HEAD(
       status: 200,
       headers: {
         'Content-Type': 'image/jpeg', // Default for HEAD requests
-        'Cache-Control': 'public, max-age=31536000, immutable',
+        'Cache-Control': 'private, max-age=31536000, immutable',
       },
     });
   } catch (error) {