feat: deliver governed Academy content

[botsarefuture]

Purpose

Close the public-content boundary so learners consume only governed published Academy content.

Changes

• Added cacheable read-only public Academy catalogue endpoint.
• Added public client adapter with bundled-content recovery fallback.
• Added course author/review/publish transitions alongside lesson governance.
• Excluded incomplete courses and unpublished lessons from public output.

Checks

• npm test (23 passing)
• npm run build
• Python server tests (9 passing)
• py_compile and diff check

Remaining

Foundations must be approved by the configured author, reviewer, and publisher accounts; this PR deliberately does not bypass that separation.