Split student-facing views and api.py into dedicated API packages

- Move JSON endpoints out of `view/api.py` into `services_api/` (SSH
  proxy + container callbacks) and `frontend_api/` (SPA `/api/v2/*` +
  scoreboard). `view/build_status.py` hosts the admin build-status poll.
- Delete Flask-rendered registration, restore-key, scoreboard, and
  chooser landing pages along with their templates, static JS/CSS, and
  vendored chart assets; the SPA serves these under `/v2/*`.
- Drop `SCOREBOARD_VIEW` setting and the view resolver — only one
  scoreboard renderer exists.
- Redirect `/`, `/student`, and `/student/` straight to the configured
  SPA landing page; admin navbar drops its public student links.
- Rework the Vue scoreboard charts to plot only per-team improvements,
  use distinct marker shapes, and support drag-pan / wheel-zoom /
  shift-drag box-zoom via `chartjs-plugin-zoom`; clamp the x-axis at
  the earliest data point and preserve zoom state across data polls.
- Refresh `ARCHITECTURE.md`, `SCOREBOARD.md`, `CLAUDE.md`, and
  `README.md` to describe the current package layout.

Author: Nils Bars

.claude/CLAUDE.md

@@ -152,10 +152,14 @@ REF is a containerized platform for hosting programming exercises with isolated
 ### Components
 
 1. **Web Application** (`webapp/`) - Flask app on port 8000
-   - `ref/view/` - Route handlers (API, exercises, grading, instances, file browser, visualization, system settings, etc.)
+   - `ref/view/` - HTML route handlers (exercises, grading, instances, file browser, visualization, admin student management, system settings, etc.)
+   - `ref/services_api/` - JSON endpoints called by services (SSH reverse proxy hooks in `ssh.py`, student container callbacks in `instance.py`)
+   - `ref/frontend_api/` - JSON endpoints consumed by the Vue SPA (registration/restore-key in `students.py`, public scoreboard in `scoreboard.py`; mounted under `/api/v2/*` + `/api/scoreboard/*`)
    - `ref/model/` - SQLAlchemy models (users, groups, exercises, instances, submissions, grades, system settings)
    - `ref/core/` - Business logic managers (`ExerciseManager`, `InstanceManager`, `ExerciseImageManager`, `UserManager`, `DockerClient`, etc.)
 
+   Student-facing pages (registration, restore-key, public scoreboard) are served by the Vue SPA under `/v2/*` and talk to `ref/frontend_api/`. Admin pages live under `ref/view/` as Jinja-rendered HTML.
+
 2. **SSH Reverse Proxy** (`ssh-reverse-proxy/`) - Rust-based SSH proxy on port 2222
    - Routes student SSH connections to exercise containers
    - Uses web API with HMAC-signed requests for authentication and provisioning
@@ -195,7 +199,7 @@ Client (ssh exercise@host -p 2222)
 
 ## Code Comments
 
-- Do not reference line numbers in comments (e.g., "see api.py lines 397-404"). Line numbers change frequently and become outdated. Reference functions, classes, or use direct code references instead.
+- Do not reference line numbers in comments (e.g., "see ssh.py lines 397-404"). Line numbers change frequently and become outdated. Reference functions, classes, or use direct code references instead.
 
 ## Pending Tasks
 

README.md

@@ -184,4 +184,4 @@ The following features are disabled by default and can be enabled from the admin
 Allows students to be organized into named groups with a configurable maximum size. Students pick a group during registration, and admins can manage the available groups and reassign students afterwards. Enable via the `GROUPS_ENABLED` setting and configure the per-group capacity via `GROUP_SIZE`.
 
 #### Scoreboard
-A public leaderboard at `/scoreboard` that ranks students based on their exercise submissions. Exercises can be grouped into assignments, the ranking strategy is selected via `SCOREBOARD_RANKING_MODE`, and the visual layout via `SCOREBOARD_VIEW`. Enable via `SCOREBOARD_ENABLED`; optionally set `LANDING_PAGE` to `scoreboard` to use it as the default landing page.
+A public leaderboard at `/v2/scoreboard` that ranks students based on their exercise submissions. Exercises can be grouped into assignments and the ranking strategy is selected via `SCOREBOARD_RANKING_MODE`. Enable via `SCOREBOARD_ENABLED`; optionally set `LANDING_PAGE` to `scoreboard` to use it as the default landing page.

docs/ARCHITECTURE.md

@@ -23,21 +23,29 @@ Flask application providing the management interface.
 
 **Key modules:**
 
-- `ref/view/` - Route handlers
-  - `api.py` - SSH proxy authentication, provisioning, instance introspection, submissions
+- `ref/view/` - HTML route handlers (admin + student dashboards)
+  - `build_status.py` - `/api/build-status` poll used by the exercises admin UI
   - `exercise.py` - Exercise import, build, delete, toggle defaults
   - `file_browser.py` - Interactive file browser with load/save
   - `grading.py` - Submission grading with search
   - `graph.py` - Network topology visualization
   - `group.py` - User group management
   - `instances.py` - Instance lifecycle (create/start/stop/delete/review/submit)
   - `login.py` - Authentication
-  - `student.py` - User management and SSH key generation/restoration
+  - `student.py` - Admin user management + signed key download endpoints; root/`/` redirect to the SPA landing pages
   - `submission.py` - Submission history
   - `system.py` - Garbage collection for dangling containers/networks
   - `system_settings.py` - System configuration (general, group, SSH settings)
   - `visualization.py` - Analytics dashboards (submission trends, container graphs)
 
+- `ref/services_api/` - JSON endpoints called by other services (not browsers)
+  - `ssh.py` - SSH reverse-proxy hooks: `/api/ssh-authenticated`, `/api/provision`, `/api/getkeys`, `/api/getuserinfo`, `/api/header`
+  - `instance.py` - Student container callbacks (HMAC-signed with per-instance keys): `/api/instance/reset`, `/api/instance/submit`, `/api/instance/info`
+
+- `ref/frontend_api/` - JSON endpoints consumed by the Vue SPA (`/api/v2/*` + scoreboard)
+  - `students.py` - `/api/v2/registration{,/meta}`, `/api/v2/restore-key`
+  - `scoreboard.py` - `/api/scoreboard/config`, `/api/scoreboard/submissions`
+
 - `ref/model/` - SQLAlchemy models
   - `user.py` - `User`, `UserGroup`
   - `exercise.py` - `Exercise`, `ExerciseService`, `ExerciseEntryService`, `RessourceLimits`