Port LTI 1.1 launch from web2py to the admin server

Moves the LTI 1.1 launch endpoint off the legacy web2py controller
(applications/runestone/controllers/lti.py) and onto the FastAPI admin
server, so web2py is no longer needed to serve LTI (1.3 was already
ported). The public launch URL /runestone/lti is preserved via a proxy
rule, so existing LMS integrations keep working with no reconfiguration.

- New rsptx.lti1p1 component: self-contained OutcomeRequest (OAuth1
  replaceResult grade passback) plus verify_lti1p1_signature and
  send_lti1p1_grade helpers (no web2py dependencies).
- New admin_server_api lti1p1 router: OAuth-verified launch that creates
  /logs in the user (JWT cookie + shared web2py session bridge),
  provisions course/instructor, and dispatches to the assignment, peer,
  practice, deep-linking (ContentItemSelection), or the course. Includes
  grade passback on first launch and a launch_error page.
- CRUD: fetch_lti1p1_config_by_consumer, upsert_lti1p1_grade_link,
  upsert_practice_grade_link. Extracted get_web2py_session_cookie from
  the 1.3 flow for reuse.
- web2py grade sync no longer depends on the launch-set
  session.oauth_consumer_key: push_lti_grades / releasegrades / practice
  grading now resolve the 1.1 record by course (_get_lti_record_for_course).
- Routing: /runestone/lti proxies to the admin server in both nginx and
  caddy, passing X-Original-URI so the OAuth signature verifies against
  the public URL.
- Add oauth2 + lxml deps and the lti1p1 brick to the admin project.
- Unit tests for signature verification and outcome-request XML.

The web2py LTI controller is intentionally left in place as a fallback
until the proxy change is deployed and confirmed.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NSYdBnh54WSQhG6Y4MAQ1x

Author: bnmnetp

bases/rsptx/admin_server_api/core.py

@@ -25,6 +25,7 @@
 from rsptx.auth.session import auth_manager
 
 from .routers import lti1p3
+from .routers import lti1p1
 from .routers import instructor
 from .routers import analytics
 from .routers import auth
@@ -47,6 +48,7 @@
 
 
 app.include_router(lti1p3.router)
+app.include_router(lti1p1.router)
 app.include_router(instructor.router)
 app.include_router(analytics.router)
 app.include_router(auth.router)