Check progress against the lesson's own course

Progress checks now validate against the lesson's actual course, not the client-provided one, preventing cross-course progress manipulation.