Preserve cohort projects, peer assignment/review, voting, and scoring

[alexeygrigorev]

Parent epic: #5

Normative spec: 04 — Preserved project/peer-review behavior

Scope

Port copied project/criteria/deadline definitions, GitHub/commit submission, required/volunteer peer assignment, criterion responses/reviews, self/duplicate prevention, voting, scoring/pass/fail/results/statistics, extensions/repairs/reassignment/notifications, and full learner plus Studio/admin API behavior using cohort scope and durable concurrency controls.

Non-goals

No scoring redesign, arbitrary synchronous URL validation/SSRF, cross-cohort reviews, or destructive criteria deletion with responses.

Acceptance criteria

• Copied project/peer characterization remains exact after Cohort retargeting.
• Peer assignment is locked/idempotent/concurrency-safe and prevents self/duplicate/cross-cohort assignment.
• Submitted URLs are syntax-validated synchronously; any network validation is bounded asynchronous SSRF-safe work.
• Criteria/result/history safe-delete rules protect responses and scores.
• Studio/admin API cover definitions, deadlines, assignment/reassignment, submissions/rubrics, votes, score/rescore, statistics, repair, and notifications.
• Recalculated results reconcile stored legacy outcomes with reported exceptions.

Test scenarios

1. Required/volunteer assignment under concurrent workers, insufficient peers, retries, self/duplicate/cross-cohort attempts.
2. Valid/invalid/private/link-local/metadata/redirect/oversize project URLs in safe validator.
3. Every rubric response/vote/scoring/pass-fail/statistics fixture, stale repair/rescore, and protected deletion.

Playwright

Learner submits project, receives/reviews peers, votes/views results; Studio authors criteria, assigns/repairs/rescores and inspects statistics at desktop/mobile with screenshots.

Dependencies

Depends on #31–#33 and #51–#54; notifications integrate with #50.