Add internal grant endpoint + temp-password / force-change flow

- /api/internal/grant: secret-auth endpoint for payment-router to
  provision access on a paid order — find-or-create user (emailVerified,
  temp password, mustChangePassword), enroll by course slug list,
  AccessLog, delivery email. Idempotent by order_id.
- User.mustChangePassword flag (+ migration); (student) layout redirects
  flagged users to /change-password (forced first-login change).
- email.ts: sendCourseGrantEmail (temp password for new buyers).
- middleware: /api/internal is public (own secret auth).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

prisma/migrations/20260614120000_add_must_change_password/migration.sql

@@ -0,0 +1,2 @@
+-- Add force-password-change flag (set for auto-provisioned buyers with a temp password)
+ALTER TABLE "User" ADD COLUMN "mustChangePassword" BOOLEAN NOT NULL DEFAULT false;

prisma/schema.prisma

@@ -24,6 +24,7 @@ model User {
   banReason     String?
   banExpires    DateTime?
   comment       String?
+  mustChangePassword Boolean @default(false)
   createdAt     DateTime  @default(now())
   updatedAt     DateTime  @updatedAt