Fix API routes: closed-question guard, file validation, files sanitization, follow-up email

- Add CLOSED status guard in messages POST (returns 409)
- Add extension allowlist check in upload route + text/x-markdown MIME type
- Sanitize files JSON array before DB write
- Add sendQuestionFollowUpEmail helper and use it for student follow-up replies
- Scope email field to staff only in questions list query

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/lib/email.ts

@@ -271,6 +271,27 @@ export async function sendQuestionReplyEmail(
   }).catch((e) => console.error("[email] sendQuestionReplyEmail:", e));
 }
 
+export async function sendQuestionFollowUpEmail(
+  to: string,
+  recipientName: string,
+  studentName: string,
+  questionTitle: string,
+) {
+  const school = await getSchoolName();
+  await getResend().emails.send({
+    from: FROM,
+    to,
+    subject: `Новый ответ от студента — ${questionTitle}`,
+    html: base(`
+      <p ${p}>Привет, ${recipientName}!</p>
+      <p ${p}>Студент <strong>${studentName}</strong> добавил сообщение в вопрос:</p>
+      ${quote(questionTitle)}
+      <p ${pLast}>Откройте панель, чтобы ответить:</p>
+      ${btn(`${BASE_URL}/admin/questions`, "Перейти к вопросам")}
+    `, school),
+  }).catch((e) => console.error("[email] sendQuestionFollowUpEmail:", e));
+}
+
 export async function sendHomeworkUpdatedEmail(
   to: string,
   recipientName: string,