feat: stages module, mobility frontend, theme toggle, employeeOnly access control

- Add stages module with full CRUD API and admin overview island
- Add mobility overview island (Liste, Kanban, Detail CRUD views)
- Add contract PDF upload/download endpoints for mobilites
- Add light/dark theme toggle in header
- Add employeeOnly flag to hide entire modules from students (admin, students, stages)
- Add read-only GET endpoints for modules/ues/ue-modules in notes module
- Add [slug].tsx catch-all routes for direct URL navigation
- Replace old mobility table with mobilites + stages schema (migration 0004)
- Allow students to create mobilites and upload contracts
- Redirect authenticated users from / to /apps catalog

routes/apps.tsx

@@ -44,9 +44,20 @@ export default async function Apps(
   _request: Request,
   context: FreshContext<State, Record<string, AppProperties>>,
 ) {
+  let visibleApps = context.data;
+
+  if (
+    context.state.isAuthenticated &&
+    context.state.session.eduPersonPrimaryAffiliation === "student"
+  ) {
+    visibleApps = Object.fromEntries(
+      Object.entries(context.data).filter(([_, app]) => !app.employeeOnly),
+    );
+  }
+
   return (
     <>
-      <AppNavigator apps={context.data} />
+      <AppNavigator apps={visibleApps} />
     </>
   );
 }