Close the gaps an audit of courses, tasks, files and grades turned up

Every area — courses, rooms, boards, topics, tasks, files, quizzes, teams,
groups, submissions, grades — was checked for data the instance has and the
tools did not show.

Grades and feedback. A teacher's /homework page is a different page from a
student's: grade and comment live in the grading form, one block per
submission, so a teacher account reported every graded submission as having
neither. parseTeacherGrading reads the form, and list_submissions can now
include the written feedback and who handed the work in.

Names. /api/v1 is partly served: courses, users and classes survive in the
deployment's ingress table, and users/{id} is the only route from an id to a
name. Submitters, file creators and course teachers resolve through it, and
degrade to "not visible to this account" where a student may not read them.

Courses, rooms and classes. get_course adds the description, teachers,
member count and weekly timetable from /api/v1/courses. list_classes is new.
get_room reports what the account may do — allowedOperations is an object of
booleans, not the list it was typed as — and applicants and invitation links
where it may manage them.

Board and topic content. Link descriptions, image alt text, drawing and
video-conference titles, the ids behind external tools and H5P content (the
only thing resembling a quiz), and what a deleted element used to be. Topic
Etherpad pads are read like board pads, and htmlToText keeps table columns
apart and drops template indentation.

Files. A scan with no text layer falls back to the preview endpoint, whose
width and outputFormat are undocumented enums, so Claude gets a picture of
the page; list_files reports counts and sizes. Teams stay documented as
unreadable at any API version; their files come later.

What the crawl missed. Tasks attached to topics (18 of 60 on the live
account), each course's own file area, and — behind INDEX_PERSONAL_FILES —
personal files and submissions with their grade comments, so search and
what_changed cover grading. A submission hit points at get_task.

The local instance's preview profile gets an ImageMagick policy that allows
the coders its 7.1.2 build needs; the image's own denies them all.

110 tests.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

test/homework-page.test.ts

@@ -1,6 +1,6 @@
 import assert from 'node:assert/strict';
 import { describe, it } from 'node:test';
-import { parseHomeworkPage } from '../src/core/homework-page.ts';
+import { parseHomeworkPage, parseTeacherGrading } from '../src/core/homework-page.ts';
 
 /**
  * Fixtures mirror the legacy client's templates (feedback.hbs, submission.hbs)
@@ -92,3 +92,63 @@ describe('parseHomeworkPage', () => {
 		assert.equal(parseHomeworkPage(html)?.submittedFiles[0]?.name, 'A&B "final".pdf');
 	});
 });
+
+/**
+ * The teacher's grading form, as the legacy client renders it.
+ *
+ * Anchored on the `name=` attributes the POST handler reads rather than on
+ * layout: one hidden `submissionId` per block, `teamMembers` naming who handed
+ * it in, a `grade` number input whose `value` is empty when ungraded (the
+ * `placeholder` is a hint, not a grade), and a `gradeComment` textarea whose
+ * body arrives HTML-escaped.
+ */
+const gradingBlock = (
+	submissionId: string,
+	submitterId: string,
+	grade: string,
+	comment: string,
+) => `
+<input name="submissionId" type="hidden" data-force-value="true" value="${submissionId}" />
+<input name="teamMembers" id="teamMembers" type="hidden" data-force-value="true" value="${submitterId}" />
+<form class="form ${submissionId}" method="post" action="/homework/submit/${submissionId}">
+  <input type="hidden" name="graded" value="true"/>
+  <label>Bewertung<small> in Prozent</small></label>
+  <input data-testid="evaluation_procent" type="number" min="0" max="100" name="grade" placeholder="95" value="${grade}" />
+  <label>Kommentar</label>
+  <textarea name="gradeComment" data-parent-id="${submissionId}" data-parent-type="gradings" data-testid="submission-comment">
+      ${comment}
+  </textarea>
+</form>`;
+
+describe('parseTeacherGrading', () => {
+	const a = 'a'.repeat(24);
+	const b = 'b'.repeat(24);
+	const student1 = '1'.repeat(24);
+	const student2 = '2'.repeat(24);
+
+	it('reads every submission on the form, with its submitter', () => {
+		const html = `<section id="submissions">${gradingBlock(a, student1, '', '&lt;p&gt;Alles richtig!&lt;/p&gt;')}${gradingBlock(b, student2, '100', '&lt;p&gt;Alles korrekt!&lt;/p&gt;')}</section>`;
+		const grading = parseTeacherGrading(html);
+		assert.equal(grading.length, 2);
+		assert.deepEqual(grading[0]?.submitterIds, [student1]);
+		assert.deepEqual(grading[1]?.submitterIds, [student2]);
+	});
+
+	it('distinguishes a feedback-only grade from a percentage', () => {
+		const html = gradingBlock(a, student1, '', '&lt;p&gt;Alles richtig!&lt;/p&gt;');
+		const [entry] = parseTeacherGrading(html);
+		// An empty value is ungraded; the placeholder "95" must not be read as one.
+		assert.equal(entry?.gradePercent, undefined);
+		assert.equal(entry?.gradeComment, 'Alles richtig!');
+	});
+
+	it('reads a percentage when one was given', () => {
+		const [entry] = parseTeacherGrading(gradingBlock(b, student2, '100', '&lt;p&gt;Gut&lt;/p&gt;'));
+		assert.equal(entry?.gradePercent, 100);
+		assert.equal(entry?.gradeComment, 'Gut');
+	});
+
+	it('returns nothing for the student view, which has no grading form', () => {
+		assert.deepEqual(parseTeacherGrading(page({ feedback: '<div data-testid="feedback-comment">Gut</div>' })), []);
+	});
+});