Add internal grant endpoint + temp-password / force-change flow

- /api/internal/grant: secret-auth endpoint for payment-router to
  provision access on a paid order — find-or-create user (emailVerified,
  temp password, mustChangePassword), enroll by course slug list,
  AccessLog, delivery email. Idempotent by order_id.
- User.mustChangePassword flag (+ migration); (student) layout redirects
  flagged users to /change-password (forced first-login change).
- email.ts: sendCourseGrantEmail (temp password for new buyers).
- middleware: /api/internal is public (own secret auth).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/app/(student)/layout.tsx

@@ -1,5 +1,6 @@
 import { headers } from "next/headers";
 import { auth } from "@/lib/auth";
+import { prisma } from "@/lib/prisma";
 import { redirect } from "next/navigation";
 import Link from "next/link";
 import { LogoutButton } from "@/components/layout/logout-button";
@@ -10,6 +11,13 @@ export default async function StudentLayout({ children }: { children: React.Reac
   const session = await auth.api.getSession({ headers: await headers() });
   if (!session) redirect("/login");
 
+  // Force password change for auto-provisioned buyers (temp password)
+  const dbUser = await prisma.user.findUnique({
+    where: { id: session.user.id },
+    select: { mustChangePassword: true },
+  });
+  if (dbUser?.mustChangePassword) redirect("/change-password");
+
   // Maintenance mode: non-admin users see the maintenance page
   if (session.user.role !== "admin") {
     const maintenance = await getSetting("maintenanceMode");