feat(courses,users): add enrollment-status, progress, quiz-attempts, module-reorder & learning-stats endpoints (#374, #381, #383, #385, #393)

[ZacLou]

Summary

This PR adds 5 new API endpoints across the courses and users modules, addressing issues #374, #381, #383, #385, and #393.

New Endpoints

Issue	Endpoint	Description
#381	GET /api/v1/courses/:id/enrollment-status	Detailed enrollment status for the current user: isEnrolled, enrolledAt, completedAt, module-by-module progress, quizCount, averageScore. Cached 30s. 404 for non-existent courses.
#385	GET /api/v1/courses/:id/progress	User's detailed progress in a course: modules completed, quizzes taken, average score, completion %, module-by-module status. Cached 30s.
#393	GET /api/v1/courses/:id/modules/:moduleId/quiz-attempts	All quiz attempts for a module by the authenticated user, ordered oldest-first. Returns attempt number, score, percentage, passed status. Cached 30s.
#374	POST /api/v1/admin/courses/:id/modules/reorder	Admin endpoint to reorder course modules atomically. Accepts {moduleIds: string[]}, validates all IDs belong to the course, updates order atomically via withLock, logs to audit trail.
#383	GET /api/v1/users/me/learning-stats	Comprehensive learning stats: courses completed, quizzes taken, average score %, credits, credentials, learning streak, estimated study time, learning velocity. Cached 5min.

Implementation Details

• All endpoints follow the existing controller → service → routes → types module pattern
• Validation via zod schemas (validate() middleware)
• Redis caching (30s for course endpoints, 5min for learning-stats) using cacheGet/cacheSet/cacheKey
• authGuard on all user-facing endpoints, adminGuard on the reorder endpoint
• NotFoundError for non-existent/inactive courses (404)
• Module lists derived from courses.modules jsonb definitions, falling back to quiz-derived moduleId groups (matching getCourseDetail's pattern)
• withLock for atomic module reordering (matching createModule/updateModule's pattern)
• Audit logging via auditLog() for the admin reorder action

Closes#374, closes#381, closes#383, closes#385, closes#393