Phase 2: LTI plumbing, roster sync, and fake-launch dev mode

OIDC login, launch, and JWKS endpoints built on pylti1p3next's Flask
adapter, with launch-claim processing split into a testable module.
Instructor launches refresh the roster through NRPS; the sync code is
source-agnostic and also drives the dev-mode fake roster. Dev mode
(COLDCALL_DEV_MODE=1) provides fake instructor and student personas
that set up the same session state as a real launch, so the rest of
the app can be developed before a Canvas Developer Key exists.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/test_roster.py

@@ -0,0 +1,82 @@
+from coldcall_lti import models
+from coldcall_lti.launch import ROLE_INSTRUCTOR, ROLE_LEARNER
+from coldcall_lti.roster import sync_roster
+
+
+def member(uid, name="A Student", roles=(ROLE_LEARNER,), status="Active", **kw):
+    return {
+        "user_id": uid,
+        "name": name,
+        "roles": list(roles),
+        "status": status,
+        **kw,
+    }
+
+
+def make_course(db):
+    course = models.Course(lti_context_id="ctx-1")
+    db.add(course)
+    db.flush()
+    return course
+
+
+def test_sync_creates_students_and_enrollments(db_session):
+    course = make_course(db_session)
+    active, deactivated = sync_roster(
+        db_session,
+        course,
+        [
+            member("u1", "Ada Lovelace", given_name="Ada", family_name="Lovelace"),
+            member("u2", "Grace Hopper"),
+            member("t1", "Teacher One", roles=[ROLE_INSTRUCTOR]),
+        ],
+    )
+    assert (active, deactivated) == (3, 0)
+
+    students = {
+        s.canvas_user_id: s for s in db_session.query(models.Student).all()
+    }
+    assert students["u1"].sortable_name == "Lovelace, Ada"
+
+    roles = {
+        e.student.canvas_user_id: e.role
+        for e in db_session.query(models.Enrollment).all()
+    }
+    assert roles == {"u1": "student", "u2": "student", "t1": "instructor"}
+
+
+def test_sync_deactivates_dropped_and_reactivates_returning(db_session):
+    course = make_course(db_session)
+    sync_roster(db_session, course, [member("u1"), member("u2")])
+
+    active, deactivated = sync_roster(db_session, course, [member("u1")])
+    assert (active, deactivated) == (1, 1)
+    dropped = (
+        db_session.query(models.Enrollment)
+        .join(models.Student)
+        .filter(models.Student.canvas_user_id == "u2")
+        .one()
+    )
+    assert not dropped.active
+
+    sync_roster(db_session, course, [member("u1"), member("u2")])
+    assert dropped.active
+
+
+def test_sync_skips_inactive_members(db_session):
+    course = make_course(db_session)
+    active, _ = sync_roster(
+        db_session,
+        course,
+        [member("u1"), member("u2", status="Inactive")],
+    )
+    assert active == 1
+    assert db_session.query(models.Student).count() == 1
+
+
+def test_sync_updates_changed_names(db_session):
+    course = make_course(db_session)
+    sync_roster(db_session, course, [member("u1", "Old Name")])
+    sync_roster(db_session, course, [member("u1", "New Name")])
+    student = db_session.query(models.Student).one()
+    assert student.name == "New Name"