Stage 13 — API Attendance

Attendance endpoint is installed.

• Protected endpoint: /api/v1/attendance/
• Bearer-token authentication required.
• Read-only; no attendance records are created, edited, or deleted.
• Pupil/student accounts are restricted to their own records.
• Parent accounts are restricted to their own children.
• Admin/staff/teacher accounts may filter by class_id or pupil_id.
• Date filters: date or from and to.
• Pagination: limit and offset.
• No database schema changes.