main
fix: add error handling to 8 API routes, clean dead store state, extract XP helper
refactor: replace manual request.json() + validateBody with parseAndValidate in 22 API routes
Auth improvements: shared passwordSchema, email normalization, alphanumeric reset codes
feat: add group management API with validation and error handling
fix: security hardening, consistent API responses, test improvements
fix: add success:true to teacher GET responses + restore double unknown cast in admin/export