Stage 24 — Pupils API
GET /api/v1/pupils/
Bearer-token protected, read-only pupil directory.
Pupils see only themselves; parents see only their children; admin/approved staff may query pupils, with optional class_id/search/adm filters.
Authentication fields are never returned.
