feat: cascade deletes, student notes, import popups, module reorganization

- Cascade delete on all entities (student, module, UE, user, role, promotion)
- Fix Response body reuse bug (factory functions instead of constants)
- Student note viewing via CAS uid (strip non-digit prefix)
- Fix middleware page visibility for students in LOCAL mode
- Import result popup component (shared across all import pages)
- Fix student import to use numEtud from Excel
- Bulk student selection with promo change and delete
- Move UE/UE-Module API and pages from notes to admin module
- Move promotions page from students to admin module
- Multi-year maquette import with per-year promo selection
- Inline promo creation in maquette import
- Static Excel templates (students, notes, maquette)
- Fix XLSX export using blob download instead of writeFile
- Allow students to read modules list (GET /modules)

routes/(apps)/_middleware.ts

@@ -21,16 +21,20 @@ export const handler: MiddlewareHandler<AuthenticatedState>[] = [
       `./${currentApp}/(_props)/props.ts`
     )).default;
 
-    context.state.availablePages = properties.pages;
+    context.state.availablePages = { ...properties.pages };
     const isStudent =
-      context.state.session.eduPersonPrimaryAffiliation == "student" &&
-      Deno.env.get("LOCAL") != "true";
+      context.state.session.eduPersonPrimaryAffiliation === "student";
+    const isLocal = Deno.env.get("LOCAL") === "true";
 
     if (isStudent) {
+      // Students only see studentOnly pages (+ non-restricted pages)
       properties.adminOnly.forEach((page) =>
         delete context.state.availablePages[page]
       );
+    } else if (isLocal) {
+      // In local mode, employees see all pages (admin + student)
     } else {
+      // In prod, employees don't see studentOnly pages
       properties.studentOnly?.forEach((page) =>
         delete context.state.availablePages[page]
       );