Read submitted text and teacher feedback from the homework page

You were right that this data never reaches the browser as an API call.
The legacy front end calls the Feathers API server-side for
submission.comment, submission.grade and submission.gradeComment and
renders them into GET /homework/{taskId}. That Feathers API is not
exposed publicly — /api/v1/* 404s — so the rendered page is the only way
to reach these fields from outside.

core/homework-page.ts parses it, hooked on the data-testid attributes
the project's own e2e tests use rather than incidental markup. The page
authenticates by jwt *cookie*; an Authorization header is ignored and
redirects to the identity provider. Every field is optional and parse
failures return undefined, so a markup change degrades to "not found"
and cannot break get_task. The wording distinguishes the two: absent
feedback is reported as not found, never as none given.

Measured on one course: 4 of 7 graded submissions carry feedback no API
call can return — "vollständig und nachvollziehbar", "Feedback siehe
Zettel", and so on.

This exposed a bug in a shared utility: htmlToText decoded only six
entities, so any named entity passed through raw. German content makes
that routine — "vollständig" would have reached the model verbatim
from boards and task descriptions too, not just here. It now decodes
named, decimal and hex references in one pass, so ä stays
literal instead of decoding twice, and leaves unknown names alone rather
than mangling them.

Also fixes a documented-recovery bug found while restoring the session:
`docker compose restart` does not re-read env_file, so it silently kept
serving the dead token. `up -d` is correct and the docs said the wrong
thing.

78 tests, 38/38 smoke; verified end to end through Claude Code.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/mcp/server.ts

@@ -25,10 +25,12 @@ How the content is organised, and the usual path through it:
   - **Tasks** ("Aufgaben") — homework. list_tasks across all courses, get_task for one.
 - **Files** hang off boards, lessons and tasks. Every listing shows file ids; download_file fetches one and
   extracts its text (PDF, Word, Excel, PowerPoint, OpenDocument) or returns an image inline.
-- **Submissions** ("Abgaben") — what the user handed in. get_task shows the submission for that task;
-  list_submissions surveys them. Only files, the graded flag and a numeric grade are available: the API
-  exposes no submitted text and no written feedback, so say so rather than implying none was given.
-  On a teacher account these tools report other people's submissions too.
+- **Submissions** ("Abgaben") — what the user handed in. get_task shows that task's submission: the files,
+  the graded flag, the grade, what the user wrote, and the teacher's written feedback. list_submissions
+  surveys them across tasks ("what is still ungraded?"). The written parts are read from the web page
+  because no API exposes them, so they can be missing even when feedback exists — if none is shown for a
+  graded submission, say it was not found rather than that none was given. On a teacher account these
+  tools report other people's submissions too.
 
 When the user names a topic rather than a course, use search — the API has no search endpoint, so it walks the
 courses and matches client-side, which takes a few seconds but covers board text and file names.