feat(gradebook): external assessment foundation - model, serialization, and inline grade entry

[LWS49]

Summary

Adds the foundation for external assessments, the only gradebook columns a professor can create, on top of the weighted gradebook view (#8436). This PR introduces the data model (external assessment + external grade), serializes externals into the gradebook payload so they render as columns in the "All assessments" view, and makes those cells inline-editable with an optimistic save. Grades store at decimal(5,2) so two-decimal imports (Canvas, SoftMark) round-trip without silent rounding, and each external carries optional floor/cap bound flags. The management panel and CSV import wizard are deferred to later PRs in this stack; this PR is model, read serialization, and single-cell write only. The grade-write endpoint (#grades) is also tightened from teaching assistant to manager.

Design decisions

• External grade/max columns use decimal(5,2) while native grade columns stay decimal(4,1) - externals are fed by Canvas/SoftMark which emit two decimals, whereas native grading is Coursemology-native where one decimal is fine. Widening every grade column would be a larger, separate change.
• Floor and cap flags are applied only at weighted-compute time (in effectiveGrade), never mutating the stored grade - the raw "All assessments" view always shows the true entered value, so toggling a flag re-interprets rather than rewrites data.
• Inline cells use the spreadsheet model (commit on blur/Enter, cancel on Esc) with an optimistic update and rollback-plus-toast on failure - this matches the Excel/Sheets idiom for a grid; entry validation and richer save feedback arrive in the validation PR.

Regression prevention

Covers: the external assessment and external grade models (validations, bounds, two-decimal precision), the synthetic-category contribution integration, the gradebook serializer's external payload, inline grade entry (optimistic apply and rollback on failure), the setExternalGrade operation, and external assessment column-id building. Migrations (20260615 create external tables, 20260616 link externals to contributions, 20260622 bounds, 20260623 decimal(5,2) precision) are reversible. The #grades authorization change is asserted in the gradebook controller spec. No change to existing gradebook behavior when a course has no externals. Model and controller specs run on CI.

---

♻️ Recreated after #8462 was auto-closed as "merged" when the base branch (feat-gradebook-export) was briefly force-pushed to a commit that contained this branch. Same head, base, and content; the base has been restored.