Stage 23 Messages API
GET /api/v1/messages/
Bearer token required. Read-only. Message content is intentionally not exposed; has_content indicates whether legacy binary content exists.
Pupil: own messages only. Parent: messages for own children. Admin/approved staff: may optionally filter by pupil_id.
