Resolve private lesson media whose file_url contains _ or %

Uploaded lesson PDFs failed to load (403) for enrolled students when the file name had an underscore or %. The access check escaped _/% in a way the query builder double-escaped, so it matched nothing and denied access. Used bound query to fix escaping.