feat(gradebook): CSV grade import for external assessments

[LWS49]

Summary

Adds CSV grade import for external assessments, reached through "Import CSV" in the manage panel. A three-step wizard defines the components, confirms the required headers and file, then previews the resolved rows before writing. Students are matched by External ID (Coursemology's term) or email, keyed by column position; headers are accepted in any order with duplicate-header reporting and near-miss ("did you mean") suggestions. The Verify step pairs each CSV identifier with its resolved student name, flags out-of-range cells as a non-blocking advisory, and blocks only on unresolved identifiers or non-numeric cells. Grade conflicts are shown as a per-student change matrix (old to new, unchanged cells dropped), and writes are batched with student emails preloaded to avoid N+1s.

Design decisions

• The wizard is a thin renderer of backend-decided state: out-of-range detection, structured conflict rows, header suggestions, and reassigned-identifier detection are computed in the import service and emitted in the preview payload - this keeps validation in one place and the wizard presentation-only.
• Import weightage is zeroed server-side unless the weighted view is enabled, placed in the controller rather than the service - the service stays a pure writer, matching where the manual-add path enforces the same rule; the hidden frontend field was previously the only guard, so a stale request could write a nonzero weight into a weighting-off course.
• Conflicts are shown as a per-student change matrix with unchanged cells dropped - the prior flat list re-counted cells identical at two decimals; the matrix shows only real changes (old to new) grouped by the student they affect.
• Identifier-first display (the CSV value plus a resolved-name column) replaces name-only rows - under an identifier-mode header, showing only the resolved name read as a mismatch; pairing the two confirms the match.

Regression prevention

Covers (backend): header order tolerance, duplicate-header reporting, near-miss header suggestion, identifier resolution and reassigned-identifier detection, out-of-range computation, structured conflict rows, the weightage-zeroing guard, the email-preload N+1 fix, and batched writes (import service and imports controller specs). Covers (frontend): the full wizard (define / template / upload / verify, did-you-mean, loading), the conflict change-matrix table (struck old value, arrow, bold new value, blank sides shown as a dash, new-fill vs existing fallback), and the template builder. Adds the imports controller route; no schema change.