feat: stages module, mobility frontend, theme toggle, employeeOnly access control

- Add stages module with full CRUD API and admin overview island
- Add mobility overview island (Liste, Kanban, Detail CRUD views)
- Add contract PDF upload/download endpoints for mobilites
- Add light/dark theme toggle in header
- Add employeeOnly flag to hide entire modules from students (admin, students, stages)
- Add read-only GET endpoints for modules/ues/ue-modules in notes module
- Add [slug].tsx catch-all routes for direct URL navigation
- Replace old mobility table with mobilites + stages schema (migration 0004)
- Allow students to create mobilites and upload contracts
- Redirect authenticated users from / to /apps catalog

routes/(apps)/_middleware.ts

@@ -21,11 +21,17 @@ export const handler: MiddlewareHandler<AuthenticatedState>[] = [
       `./${currentApp}/(_props)/props.ts`
     )).default;
 
-    context.state.availablePages = { ...properties.pages };
     const isStudent =
       context.state.session.eduPersonPrimaryAffiliation === "student";
     const isLocal = Deno.env.get("LOCAL") === "true";
 
+    // Block students from accessing employeeOnly modules entirely
+    if (isStudent && properties.employeeOnly) {
+      return new Response(null, { status: 403 });
+    }
+
+    context.state.availablePages = { ...properties.pages };
+
     if (isStudent) {
       // Students only see studentOnly pages (+ non-restricted pages)
       properties.adminOnly.forEach((page) =>