Courses: the first seven slices, hidden

Internal: the first seven build slices of Courses (docs/specs/COURSES.md), all behind CoursesPolicy::MEMBERS_ENABLED = false, which hides the area and its addresses from everyone but site admins. Shared changes: accounts found or made from a typed email for course enrolments and orders (GuestCheckoutService), a reusable byte-range and private-file response, a name-and-email list parser, mail attachments, and a school-branded sign-in link. Foundation: the Courses tables (migrations 2922 to 2924), the course list, the outline with modules and lessons, the lesson editor, the email outbox and worker, the assistant read, search, Recent work, Trash and plan limits. Video: uploads in parts, processing with ffmpeg into private storage, streaming with signed, session-bound addresses, captions and the player. The school: catalogue, course pages, course home, lessons with release rules and progress, free and approved enrolment, My courses, Your courses, the Dashboard band and Courses settings. Quizzes, assignments with review, completion and certificates with a public check page. Selling through Store: the course product kind, access granted on every paid path and ended by a full refund, and a refusal at checkout for a course the buyer already has. Payment plans in Store (Checkout in subscription mode on the team's Stripe account) and courses included in Supporters tiers. Slices 8 to 13 (cohorts, discussion, emails, student lists and reports, import and the custom domain, Help) follow.