Broken access control

Added server-side authorization checks to get_profile_details (filters privileged roles from students), track_video_watch_duration (requires lesson access), and submit_quiz (requires quiz access).