Fix API routes: closed-question guard, file validation, files sanitization, follow-up email

- Add CLOSED status guard in messages POST (returns 409)
- Add extension allowlist check in upload route + text/x-markdown MIME type
- Sanitize files JSON array before DB write
- Add sendQuestionFollowUpEmail helper and use it for student follow-up replies
- Scope email field to staff only in questions list query

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/app/api/student/question-upload/route.ts

@@ -6,7 +6,7 @@ import { randomUUID } from "crypto";
 
 const ALLOWED_TYPES = new Set([
   "image/jpeg", "image/png", "image/gif", "image/webp",
-  "application/pdf", "text/markdown", "text/plain",
+  "application/pdf", "text/markdown", "text/x-markdown", "text/plain",
 ]);
 const MAX_BYTES = 10 * 1024 * 1024; // 10 MB
 
@@ -30,6 +30,11 @@ export async function POST(req: NextRequest) {
   }
 
   const ext = file.name.split(".").pop()?.toLowerCase() ?? "bin";
+  const ALLOWED_EXTS = new Set(["jpg", "jpeg", "png", "gif", "webp", "pdf", "md", "txt"]);
+  if (!ALLOWED_EXTS.has(ext)) {
+    return NextResponse.json({ error: "Недопустимое расширение файла" }, { status: 415 });
+  }
+
   const key = `questions/tmp/${session.user.id}/${randomUUID()}.${ext}`;
   const buffer = Buffer.from(await file.arrayBuffer());
   const url = await uploadFile(key, buffer, file.type);