Rewire Gradescope sync onto enrollment-keyed gradebook (post-redesign)

[AndresL230]

Context

The DB modular redesign (PR #264, branch db/schema-foundation) absorbed the Gradescope DB tables from origin/Gradebook (0020_gradescope.sql) and re-expressed them against the new enrollment-keyed schema (migrations 0021 + 0027). That migration file on origin/Gradebook is now superseded — drop it. This issue tracks the code rewire so the Gradescope sync works against the new schema.

What changed in the schema

Original (origin/Gradebook)	Redesigned (PR #264)
gradescope_credentials (user_id PK, encrypted)	unchanged ✓ (0027)
gradescope_course_links.sapling_course_id → courses(id)	enrollment_id → enrollments(id), UNIQUE(enrollment_id, gradescope_course_id) (0027)
assignments.gradescope_assignment_id + unique idx on (course_id, …)	kept; idempotency index re-targeted to (enrollment_id, gradescope_assignment_id) (0021) — assignments are now enrollment-scoped

Code to rewire

• The sync upsert must key on enrollment_id, not course_id (assignments no longer carry course_id).
• The course-picker links a Gradescope course to a user's enrollment (a specific class instance), not an abstract course. Confirm this matches the intended UX — if linking should be per-abstract-course, adjust the 0027 FK and the picker together.
• Credentials encrypt/decrypt is unchanged (email/password/cookies are 🔒 encrypted TEXT).

Acceptance

• Gradescope sync upserts grades into the correct enrollment's assignments, idempotently, against the new schema; tests updated.

Refs: PR #264 · supersedes origin/Gradebook:backend/db/migrations/0020_gradescope.sql.