feat: vibe lens ai solver

[Khushidosi13]

Description

This pull request integrates the ViBe Lens AI Solver, an AI-powered helper tool designed to enhance the student learning experience:

• ViBe Lens Notebook: Allows students to capture snapshots of video frames (such as code snippets or diagram slides) directly from their lecture player, save them to their notebook, and crop specific areas of interest.
• AI Code Solver: Explains the selected code or concepts in a clear, student-friendly layout with copyable code snippets.
• Course-Wide Control: Provides instructors with a single settings toggle to enable or disable the ViBe Lens AI Solver feature for the entire course.

[JoelJosephPhilip]

Reviewed this. There are a few serious issues, and the PR currently has merge conflicts with main.

The "AI Code Solver" isn't actually AI : it's hardcoded demo content. frontend/src/components/vibe-lens-panel.tsx has no API call anywhere in it (no fetch, no backend route, nothing in backend/src for a lens/solver endpoint). The "explanation" is matched entirely off specific YouTube video IDs (zjkBMFhNj_g, pBBe1pk8yKw, 94BdnDVHrP0) or by checking crop pixel coordinates (e.g. if (cropY < 12) → a hardcoded "VS Code File Navigation Tab Menu" explanation). For any video that isn't one of those three demo IDs, it falls back to a generic made-up "ViBe Course Dashboard" explanation based only on crop position, not the actual frame content. This explains the backend/scratch/download_*.js scripts too : they exist to download those exact three videos. As it stands, this only "works" for the demo videos; on a real course it will confidently show students an explanation that has nothing to do with what they captured.

Breaks real login. In AuthController.ts:

const authHost = process.env.FIREBASE_AUTH_EMULATOR_HOST
  ? `http://${process.env.FIREBASE_AUTH_EMULATOR_HOST}`
  : 'https://identitytoolkit.googleapis.com';
const data = await fetch(
  `${authHost}/identitytoolkit.googleapis.com/v1/accounts:signInWithPassword?key=...`,

Outside the local emulator, authHost is already https://identitytoolkit.googleapis.com, so the final URL doubles the path to .../identitytoolkit.googleapis.com/identitytoolkit.googleapis.com/v1/.... That 404s against the real Firebase endpoint, so password sign-in would break anywhere this isn't running against the local Auth Emulator.

Validation regression: @IsUrl() was removed from the video URL field in ItemValidators.ts with no explanation, so that field now accepts any string.

Shouldn't be in this PR: 25 debug/scratch scripts under backend/scratch/ plus backend/start_emulator.js — hardcoded test credentials, hardcoded mongodb://localhost:27017 connections, and two new backend dependencies (@distube/ytdl-core, youtube-dl-exec) added only to download the three demo videos referenced above.

Unrelated changes bundled in, worth a second look: BaseService._withTransaction (the shared transaction helper used across the whole app) now silently falls back to no-session mode on a specific Mongo error string; versionStatus: "published" was added to several $or filters in CourseRepository/EnrollmentRepository that previously only matched "active", which changes what counts as visible/enrollable course-wide, not just for this feature.

Also: GitHub is showing this PR as conflicting with main (CONFLICTING/DIRTY) : could you rebase/merge and resolve those before this goes further?

[JoelJosephPhilip]

Requesting changes see the detailed comment above. Two blocking issues plus the open conflicts:

• The "AI Code Solver" has no real AI/backend call anywhere : it's hardcoded demo content keyed to three specific YouTube video IDs, with a generic made-up fallback for everything else.
• AuthController.ts's password sign-in builds a doubled, broken URL outside the local Firebase emulator, which breaks real login.
• The PR is currently showing as conflicting with main and needs a rebase/merge.

Happy to re-review once these are addressed.