Implement remix endpoints

[abcampo-iry]

Closes: https://github.com/RaspberryPiFoundation/digital-editor-issues/issues/1237

POST /api/scratch/projects now performs the real Scratch first-save remix flow for logged-in users with Scratch enabled. The endpoint is remix-only: it requires is_remix=1 and original_id, loads the original project from original_id, returns 401 if the current user cannot access that project, translates the Scratch save payload into scratch_component content, calls Project::CreateRemix, and returns the Scratch response shape:
{ "status": "ok", "content-name": "" }

Also included:

• i18n for the new Scratch remix error messages
• request coverage for the Scratch create endpoint
• unit coverage for the Scratch remix branch in CreateRemix

remix-flow.mov

[github-actions]

Test coverage

90.15% line coverage reported by SimpleCov.
Run: https://github.com/RaspberryPiFoundation/editor-api/actions/runs/23489183783

[Copilot]

Pull request overview

This PR turns POST /api/scratch/projects into a real “remix-only” endpoint and aligns Scratch remix creation with the shared remix creation path used by HTML/Python, while fixing context loading for remixed projects without lessons.

Changes:

• Implement Scratch remix creation in Api::Scratch::ProjectsController#create, including original project loading and authorization.
• Extend Project::CreateRemix to generate identifiers server-side and to copy components/Scratch content from the original when not supplied.
• Fix project context JSON rendering and authorization for student remixes without lessons, with supporting request/spec updates.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
app/controllers/api/scratch/projects_controller.rb	Implements real Scratch remix creation flow and request parsing for Scratch content.
lib/concepts/project/operations/create_remix.rb	Updates shared remix operation to support server-side identifiers and Scratch content copying/override.
app/models/ability.rb	Grants show_context ability for relevant project-access paths (own projects + student remixes).
app/views/api/projects/context.json.jbuilder	Makes class_id derivation nil-safe when a project has no lesson.
spec/requests/projects/show_context_spec.rb	Adds coverage for student loading context of their own remix without a lesson.
spec/features/scratch/creating_a_scratch_project_spec.rb	Expands request coverage for Scratch remix creation (auth, gating, missing/invalid original, unauthorized original, success behavior).
spec/concepts/project/create_remix_spec.rb	Adds unit coverage for copying/overriding Scratch component content during remix.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[zetter-rpf]

editor-standalone loads GET /api/projects/:id/context when opening a school project page directly.

Student remixes already use the existing remix shape (lesson_id = nil, remixed_from_id = original.id). Once Scratch started creating real remixes through the API, that direct-load path exposed two existing gaps:

the student remix permission needed to allow the show_context action
the context JSON needed to handle projects with no lesson (create_remix.rb:66 clears lesson_id on the new remixed project)

Thanks for explaining, but still don't fully understand this problem and the need for the new permission. Is this something that is not working at the moment for non-scratch projects? Around for talking though if easier.