feat(perm): block API endpoints for globally-disabled features (B-lite)
Adds backend/src/middleware/features.js with requireFeature(name)
that returns 404 when app_settings.feature_<name>_enabled='0'.
Wired on 8 routes:
- /api/pet (pet)
- /api/collection (collection)
- /api/red-book (red_book)
- /api/flashcards (flashcards)
- /api/knowledge-map (knowledge_map)
- /api/biochem (biochem)
- /api/games/hangman/* (hangman, per-route inside games router)
- /api/games/crossword/* (crossword, per-route)
Scope: GLOBAL only. Per-class disable (classes.features JSON) and the
free_student role overlay remain UI-gated. Add user-aware merge later
if needed (extract logic from /api/features endpoint into shared helper).
Not gated (intentional, core teacher tools): board, classroom, live_quiz.
Smoke: pet disabled → 404; enabled → 401 (auth-required passthrough).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Maxim Dolgolyov
19c16bdfe8