Add threaded comment replies for admin and curator

- Add parentId field to LessonComment (self-referential FK, SetNull on delete)
- Show replies indented under parent comment with left border visual
- Add reply button (visible to admin/curator only) with inline textarea
- Only root comments shown in main list; replies nested below their parent
- Update comment count to include replies
- Server-side validation: only admin/curator can reply, parent must belong to same lesson

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/lib/actions/student-actions.ts

@@ -138,7 +138,7 @@ export async function submitQuizAttempt(
 
 // ── Comments ──────────────────────────────────────────────────────────────────
 
-export async function addComment(lessonId: string, slug: string, text: string) {
+export async function addComment(lessonId: string, slug: string, text: string, parentId?: string) {
   const session = await auth.api.getSession({ headers: await headers() });
   if (!session) throw new Error("Unauthorized");
 
@@ -152,7 +152,8 @@ export async function addComment(lessonId: string, slug: string, text: string) {
   if (!lesson) throw new Error("Lesson not found");
 
   const isAdmin = session.user.role === "admin";
-  if (!isAdmin) {
+  const isCurator = session.user.role === "curator";
+  if (!isAdmin && !isCurator) {
     const enrollment = await prisma.courseEnrollment.findUnique({
       where: {
         userId_courseId: {
@@ -165,8 +166,14 @@ export async function addComment(lessonId: string, slug: string, text: string) {
     if (enrollment.expiresAt && enrollment.expiresAt < new Date()) throw new Error("Access expired");
   }
 
+  if (parentId) {
+    if (!isAdmin && !isCurator) throw new Error("Forbidden");
+    const parent = await prisma.lessonComment.findUnique({ where: { id: parentId } });
+    if (!parent || parent.lessonId !== lessonId) throw new Error("Invalid parent");
+  }
+
   await prisma.lessonComment.create({
-    data: { lessonId, userId: session.user.id, text: trimmed },
+    data: { lessonId, userId: session.user.id, text: trimmed, ...(parentId ? { parentId } : {}) },
   });
 
   revalidatePath(`/courses/${slug}/lessons/${lessonId}`);