Close the gaps an audit of courses, tasks, files and grades turned up

Every area — courses, rooms, boards, topics, tasks, files, quizzes, teams,
groups, submissions, grades — was checked for data the instance has and the
tools did not show.

Grades and feedback. A teacher's /homework page is a different page from a
student's: grade and comment live in the grading form, one block per
submission, so a teacher account reported every graded submission as having
neither. parseTeacherGrading reads the form, and list_submissions can now
include the written feedback and who handed the work in.

Names. /api/v1 is partly served: courses, users and classes survive in the
deployment's ingress table, and users/{id} is the only route from an id to a
name. Submitters, file creators and course teachers resolve through it, and
degrade to "not visible to this account" where a student may not read them.

Courses, rooms and classes. get_course adds the description, teachers,
member count and weekly timetable from /api/v1/courses. list_classes is new.
get_room reports what the account may do — allowedOperations is an object of
booleans, not the list it was typed as — and applicants and invitation links
where it may manage them.

Board and topic content. Link descriptions, image alt text, drawing and
video-conference titles, the ids behind external tools and H5P content (the
only thing resembling a quiz), and what a deleted element used to be. Topic
Etherpad pads are read like board pads, and htmlToText keeps table columns
apart and drops template indentation.

Files. A scan with no text layer falls back to the preview endpoint, whose
width and outputFormat are undocumented enums, so Claude gets a picture of
the page; list_files reports counts and sizes. Teams stay documented as
unreadable at any API version; their files come later.

What the crawl missed. Tasks attached to topics (18 of 60 on the live
account), each course's own file area, and — behind INDEX_PERSONAL_FILES —
personal files and submissions with their grade comments, so search and
what_changed cover grading. A submission hit points at get_task.

The local instance's preview profile gets an ImageMagick policy that allows
the coders its 7.1.2 build needs; the image's own denies them all.

110 tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/core/etherpad.ts

@@ -98,3 +98,57 @@ export function padIdFromUrl(url: string, baseUrl: string): string | undefined {
 	const segment = /\/etherpad\/p\/([^/?#]+)/.exec(parsed.pathname)?.[1];
 	return segment && segment.length > 0 ? segment : undefined;
 }
+
+/**
+ * The text of a pad linked from a *topic* ("Thema"), as opposed to a board.
+ *
+ * Topics reach Etherpad differently from column boards: there is no
+ * `collaborative-text-editor` element to ask, only a stored pad url on the
+ * lesson component. The session cookie comes from the topic page instead —
+ * the legacy client requests an Etherpad session on every topic page whose
+ * lesson has contents, whether or not a pad is present, so simply rendering
+ * the page yields one. Everything here is a GET.
+ *
+ * The stored url is data and may point anywhere; `padIdFromUrl` refuses any
+ * host but this instance's, so a pad recorded against another deployment is
+ * reported as a link rather than fetched — which is the correct outcome, not
+ * a failure.
+ */
+export async function fetchLessonPadText(
+	config: Config,
+	courseId: string,
+	lessonId: string,
+	padUrl: string,
+): Promise<string | undefined> {
+	const padId = padIdFromUrl(padUrl, config.baseUrl);
+	if (!padId) return undefined;
+
+	try {
+		const page = await fetch(
+			`${config.baseUrl}/courses/${encodeURIComponent(courseId)}/topics/${encodeURIComponent(lessonId)}`,
+			{
+				headers: { Cookie: `jwt=${config.jwt}`, Accept: 'text/html' },
+				signal: AbortSignal.timeout(config.requestTimeoutMs),
+				redirect: 'follow',
+			},
+		);
+		if (!page.ok) return undefined;
+
+		const sessionCookie = page.headers
+			.getSetCookie()
+			.map((cookie) => /^(sessionID=[^;]*)/.exec(cookie)?.[1])
+			.find((value): value is string => Boolean(value));
+		if (!sessionCookie) return undefined;
+
+		const response = await fetch(`${new URL(config.baseUrl).origin}/etherpad/p/${padId}/export/txt`, {
+			headers: { Cookie: sessionCookie, Accept: 'text/plain' },
+			signal: AbortSignal.timeout(config.requestTimeoutMs),
+		});
+		if (!response.ok) return undefined;
+
+		const text = (await response.text()).trim();
+		return text.length > 0 && text !== DEFAULT_PAD_TEXT ? text : undefined;
+	} catch {
+		return undefined;
+	}
+}