feat(gradebook): decimal-ceiling cap entry, over-max flags, and out-of-range warnings

[LWS49]

Summary

Hardens grade entry and surfaces out-of-range data for external assessments. Grade and max entry are capped at the decimal(5,2) ceiling at the input layer; negative manual entry is allowed (floor-at-zero presumes penalty columns) while non-numeric input is rejected at entry instead of being silently discarded. Over-max and below-zero grades show an inline indicator whose tooltip copy is weighted-view-aware (states the read-time capping consequence only when weighting is on). A persistent below-the-tabs banner aggregates how many grades across how many externals are outside their range. Max marks become read-only in the table (edited only via the panel's Edit prompt).

Design decisions

• Inline max-marks editing was removed; max is editable only through the panel's Edit prompt - max is a column-definition value (subheader), not per-student data, so it belongs in a deliberate dialog rather than a one-click header edit, and it is coupled to the "Cap at max" toggle which only the Edit prompt shows alongside it.
• Out-of-range is surfaced at three layers with distinct jobs: per-cell icons (locate), the import Verify warning (entry-time), and the aggregate banner (review-before-export). The banner is scoped to flags that are on, since nothing is clamped when a flag is off.

Regression prevention

Covers: outOfRange computation, the OutOfRangeAlert component, cap-at-2dp entry, below-zero icon presence/absence, weighted vs non-weighted tooltip copy, read-only max cell, and the GradebookIndex out-of-range summary (frontend suites green). No behavior change to stored grades (read-time only). Import controller/service specs run on push/CI.

Screenshots worth adding: the out-of-range banner, and an over-max cell tooltip in weighted vs non-weighted view.

[hound]

[Correctable] Layout/EmptyLineAfterGuardClause: Add empty line after guard clause.

[LWS49]

Superseded by #8464 (renamed to convention; also now carries the inline save-confirmation toast).