feat(perm): block API endpoints for globally-disabled features (B-lite)

Adds backend/src/middleware/features.js with requireFeature(name)

that returns 404 when app_settings.feature_<name>_enabled='0'.

Wired on 8 routes:

- /api/pet            (pet)

- /api/collection     (collection)

- /api/red-book       (red_book)

- /api/flashcards     (flashcards)

- /api/knowledge-map  (knowledge_map)

- /api/biochem        (biochem)

- /api/games/hangman/*   (hangman, per-route inside games router)

- /api/games/crossword/* (crossword, per-route)

Scope: GLOBAL only. Per-class disable (classes.features JSON) and the

free_student role overlay remain UI-gated. Add user-aware merge later

if needed (extract logic from /api/features endpoint into shared helper).

Not gated (intentional, core teacher tools): board, classroom, live_quiz.

Smoke: pet disabled → 404; enabled → 401 (auth-required passthrough).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

backend/src/server.js

@@ -130,6 +130,7 @@ app.use(express.json({ limit: '1mb' }));
 
 /* ── Global API rate limit ── */
 const rateLimit = require('./middleware/rateLimit');
+const { requireFeature } = require('./middleware/features');
 // Classroom real-time endpoints (cursor, stroke-preview) fire ~10/s per user — higher limit
 app.use('/api/classroom', rateLimit({ windowMs: 60_000, max: 6000, message: 'Слишком много запросов' }));
 app.use('/api', rateLimit({ windowMs: 60_000, max: 600, message: 'Слишком много запросов, подождите минуту' }));
@@ -154,7 +155,7 @@ app.use('/api/shop',          shopRoutes);
 app.use('/api/templates',     templateRoutes);
 app.use('/api/bookmarks',    bookmarkRoutes);
 app.use('/api/search',       searchRoutes);
-app.use('/api/flashcards',   flashcardRoutes);
+app.use('/api/flashcards',   requireFeature('flashcards'), flashcardRoutes);
 app.use('/api/settings',    settingsRoutes);
 app.use('/api/preferences', require('./routes/preferences'));
 app.use('/api/avatar',     require('./routes/avatar'));
@@ -163,11 +164,11 @@ app.use('/api/live',              liveRoutes);
 app.use('/api/classroom/guest',   guestClassroomRoutes); // public — MUST be before /api/classroom
 app.use('/api/classroom',         classroomRoutes);
 app.use('/api/games',        gamesRoutes);
-app.use('/api/knowledge-map', knowledgeMapRoutes);
-app.use('/api/pet',          petRoutes);
-app.use('/api/collection',   collectionRoutes);
-app.use('/api/red-book',     redBookRoutes);
-app.use('/api/biochem',      require('./routes/biochem'));
+app.use('/api/knowledge-map', requireFeature('knowledge_map'), knowledgeMapRoutes);
+app.use('/api/pet',          requireFeature('pet'),           petRoutes);
+app.use('/api/collection',   requireFeature('collection'),    collectionRoutes);
+app.use('/api/red-book',     requireFeature('red_book'),      redBookRoutes);
+app.use('/api/biochem',      requireFeature('biochem'),       require('./routes/biochem'));
 app.use('/api/parent',       parentRoutes);
 app.use('/api/exam9',        exam9Routes);
 app.use('/api/textbooks',    textbookRoutes);