Stage 16 — API Timetable

Timetable endpoint is installed.

• Protected endpoint: /api/v1/timetable/
• Bearer-token authentication required.
• Read-only; timetable records are not created, edited, or deleted.
• Pupil/student accounts are restricted to their current class.
• Parent accounts are restricted to classes containing their children.
• Admin and approved staff roles may retrieve timetable records.
• Optional filters: class_id, day, date.
• Pagination: limit and offset.
• No database schema changes.