feat(admin): DELETE /admin/courses/:id/modules/:moduleId/quizzes/:quizId (#414)

[ZacLou]

What

Adds DELETE /api/v1/admin/courses/:id/modules/:moduleId/quizzes/:quizId (#414): removes a quiz together with all its submissions atomically, in one DB transaction.

Implementation

• QuizService.deleteQuizByAdmin(courseId, moduleId, quizId) — runs under withLock(quiz-delete:<id>):
  • resolves the quiz inside the transaction and 404s (a) if it doesn't exist, (b) if its course/module doesn't match the path — the guard runs before the delete so a mismatched URL can never destroy a different course's quiz
  • counts the quiz's submissions first, so the audit entry records how many attempts were destroyed (a plain cascade delete leaves no such trace)
  • tx.delete(quizzes) — quizSubmissions and quizFeedback are removed by the FK cascades in the same commit
• Audit: new quiz.deleted_by_admin event carrying courseId / moduleId / quizId / total (submission count).
• Cache: invalidates the aggregate quizzes:stats:* pattern plus the course-scoped and global stats keys. Per-user progress/module keys are short-TTL (30s) and tied to unenumerable per-user IDs, so they age out on their own — the same policy retryQuiz already follows.
• Admin route on admin-course.routes (authGuard + adminGuard), Fastify swagger schema with uuid params.

Note on testing

tests/unit/quizzes/admin-delete-quiz.test.ts — 4 cases: happy path with audit payload, missing-quiz 404, cross-course/module guard (delete never reached), stats-cache invalidation. All 4 pass.

Repository-wide tsc --noEmit carries pre-existing errors on main (verified against a clean worktree of 4765abb — 151 errors, zero introduced by this PR; the admin-course.controller errors listed there exist on stock main too).

Closes #414