Fix watch tracking, video unlocking and access-control gaps

Watch progress and unlocking:
- Player samples the playhead and reports the ranges actually played,
  so skipped sections earn no credit and early plays are not lost
- Server merges ranges into compact segment rows; progress never regresses
- Single 80% unlock rule enforced server-side (lib/watch-progress.ts);
  the Unlock button and automatic unlock now agree
- Lock state and progress bar update live from each progress save
- Playlist is derived from the video, so unlocks work for shared
  playlists and for links from watch history and liked videos
- First/previous video decided by playlist position, not index numbers

Access control:
- Video API and HLS/MP4 routes require a signed-in viewer who is
  enrolled and has the video unlocked; thumbnails require sign-in
- Enrolment sync reads course codes from the allow-list, not the request
- /api/admin/meta is admin-only
- Account status, role and levels are re-checked from the database
  during a session, so deactivated students lose access within a minute

Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com>

app/api/user/unlocks/route.ts

@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server';
 import { getServerSession } from 'next-auth';
 import { authOptions } from '@/lib/auth-options';
 import { prisma } from '@/lib/prisma';
+import { checkUnlockEligibility } from '@/lib/watch-progress';
 
 export async function GET(req: Request) {
   try {
@@ -59,40 +60,31 @@ export async function POST(req: Request) {
     if (!user)
       return NextResponse.json({ error: 'user not found' }, { status: 404 });
 
-    // Verify video exists
-    const video = await prisma.video.findUnique({
-      where: { id: videoId },
-      select: { id: true, locked: true, instantAccess: true },
-    });
-
-    if (!video) {
-      return NextResponse.json({ error: 'video not found' }, { status: 404 });
+    // Admins can open anything; everyone else must have earned the unlock.
+    const role = (session.user as any).role;
+    const isAdmin = role === 'admin' || role === 'superadmin';
+    if (!isAdmin) {
+      const check = await checkUnlockEligibility(user.id, videoId);
+      if (!check.ok) {
+        return NextResponse.json({ error: check.error }, { status: check.status });
+      }
+      if (check.free) {
+        return NextResponse.json({ message: 'Video does not need unlocking', unlock: null });
+      }
+    } else {
+      const exists = await prisma.video.findUnique({ where: { id: videoId }, select: { id: true } });
+      if (!exists) {
+        return NextResponse.json({ error: 'video not found' }, { status: 404 });
+      }
     }
 
-    // Check if already unlocked
-    const existingUnlock = await prisma.videoUnlock.findUnique({
+    const unlock = await prisma.videoUnlock.upsert({
       where: { userId_videoId: { userId: user.id, videoId } },
+      update: {},
+      create: { userId: user.id, videoId },
     });
 
-    if (existingUnlock) {
-      return NextResponse.json({ 
-        message: 'Video already unlocked',
-        unlock: existingUnlock 
-      });
-    }
-
-    // Create the unlock record
-    const unlock = await prisma.videoUnlock.create({
-      data: {
-        userId: user.id,
-        videoId: videoId,
-      },
-    });
-
-    return NextResponse.json({ 
-      message: 'Video unlocked successfully',
-      unlock 
-    });
+    return NextResponse.json({ message: 'Video unlocked successfully', unlock });
 
   } catch (err: any) {
     console.error('user unlocks POST error', err);