Harden access-control checks

Enforces server-side authorization on LMS endpoints to restrict access to enrolled courses, instructor-only fields, and assignment grading.