Phase 9c: Parent accounts, magic-link login + parent timetable view

Backend (school-service):
  - parent_account, parent_child, parent_magic_link, parent_session
    tables. Tokens are sha256-hashed in DB; raw goes back exactly
    once to the inviting teacher.
  - InviteParent upserts the parent account, links a child to a tt_
    class, mints a 7-day magic link. Returns the link path so the
    teacher can paste it into Matrix/Email.
  - RedeemMagicLink validates + marks used + mints a 30-day session,
    sets HttpOnly bp_parent_session cookie.
  - ParentSessionMiddleware reads the cookie and resolves the parent.
    Lives in its own router group /api/v1/parent — totally separate
    from the teacher JWT path.
  - ParentMe returns the account + list of children (with class name).
  - ParentTimetable returns the latest completed tt_solution's lessons
    for the requested child's class, with full authorization check
    (parent must own a child in that class).

Frontend (studio-v2):
  - lib/calendar/subject-i18n.ts maps 22 German subject names to 8
    parent locales (de/en/tr/ar/uk/ru/pl/fr). Falls back to German
    for custom subjects.
  - ParentManager component on the Schulkalender page lets the teacher
    invite parents via email + child name + class + language. Newly
    minted magic-link is shown with a copy-to-clipboard button.
  - app/api/parent/[...path]/route.ts proxies parent-side endpoints
    via the cookie so HttpOnly survives the Next.js round-trip.
  - /eltern/login?token=… redeems and redirects to /eltern.
  - /eltern shows a Wochengrid with German days + translated subject
    names in the parent's preferred language. Headings and weekday
    labels also localised (de/en/tr/ar/uk/ru/pl/fr).

Tests:
  - 3 new Go unit tests (random token, hash stability, invite-request
    validator). 83 subtests gesamt.
  - studio-v2: e2e/eltern.spec.ts mit 7 tests across ParentManager,
    /eltern/login, /eltern overview, subject-i18n end-to-end.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

school-service/internal/database/database.go

@@ -224,6 +224,9 @@ func Migrate(db *DB) error {
 	// Append calendar migrations (see calendar_migrations.go).
 	migrations = append(migrations, CalendarMigrations()...)
 
+	// Append parent migrations (Phase 9c — see parent_migrations.go).
+	migrations = append(migrations, ParentMigrations()...)
+
 	for _, migration := range migrations {
 		_, err := db.Pool.Exec(ctx, migration)
 		if err != nil {

school-service/internal/database/parent_migrations.go

@@ -0,0 +1,53 @@
+package database
+
+// ParentMigrations creates the four parent-side tables for Phase 9c:
+//
+//   parent_account     — one row per invited parent (email, language)
+//   parent_child       — kids linked to a parent and a tt_class
+//   parent_magic_link  — one-shot invite tokens, hashed
+//   parent_session     — active browser sessions after redeeming a link
+//
+// The teacher owns the invite (created_by_user_id on account); parent sees
+// only data scoped to their own children's class via tt_class.id.
+func ParentMigrations() []string {
+	return []string{
+		`CREATE TABLE IF NOT EXISTS parent_account (
+			id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+			created_by_user_id UUID NOT NULL,
+			email VARCHAR(255) NOT NULL,
+			preferred_language VARCHAR(8) DEFAULT 'de',
+			created_at TIMESTAMPTZ DEFAULT NOW(),
+			UNIQUE(created_by_user_id, email)
+		)`,
+
+		`CREATE TABLE IF NOT EXISTS parent_child (
+			id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+			parent_id UUID NOT NULL REFERENCES parent_account(id) ON DELETE CASCADE,
+			tt_class_id UUID NOT NULL REFERENCES tt_class(id) ON DELETE CASCADE,
+			first_name VARCHAR(100) NOT NULL,
+			last_name VARCHAR(100) NOT NULL,
+			created_at TIMESTAMPTZ DEFAULT NOW()
+		)`,
+
+		`CREATE TABLE IF NOT EXISTS parent_magic_link (
+			id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+			parent_id UUID NOT NULL REFERENCES parent_account(id) ON DELETE CASCADE,
+			token_hash VARCHAR(64) NOT NULL UNIQUE,
+			expires_at TIMESTAMPTZ NOT NULL,
+			used_at TIMESTAMPTZ,
+			created_at TIMESTAMPTZ DEFAULT NOW()
+		)`,
+
+		`CREATE TABLE IF NOT EXISTS parent_session (
+			id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+			parent_id UUID NOT NULL REFERENCES parent_account(id) ON DELETE CASCADE,
+			token_hash VARCHAR(64) NOT NULL UNIQUE,
+			expires_at TIMESTAMPTZ NOT NULL,
+			created_at TIMESTAMPTZ DEFAULT NOW()
+		)`,
+
+		`CREATE INDEX IF NOT EXISTS idx_parent_account_owner ON parent_account(created_by_user_id)`,
+		`CREATE INDEX IF NOT EXISTS idx_parent_child_parent ON parent_child(parent_id)`,
+		`CREATE INDEX IF NOT EXISTS idx_parent_child_class ON parent_child(tt_class_id)`,
+	}
+}