Engagement heatmap API for unit-scoped task activity

[davidngash98]

Summary
This adds a new backend API endpoint to support the Heatmap module for OnTrack. The endpoint provides an 84-day view of student task engagement activity, scoped strictly to a single project (enrolment). This will power the frontend heatmap visualisation without leaking data across units or projects.

Key Changes

New Service: app/services/engagement_heatmap_service.rb

• Calculates activity for the last 84 days (server timezone).
• Groups TaskEngagement records by day with proper date normalization.
• Computes tasks_completed, active_days, and current_streak.
• Strictly scoped to the requested project’s tasks only.

New API Endpoint: GET /api/projects/:id/engagement_heatmap

• Added to projects_api.rb.
• Uses standard authentication + authorise?(current_user, project, :get).
• Returns consistent JSON contract: project_id, unit_id, range, days[], and summary.

Tests: Added comprehensive tests in test/api/projects_api_test.rb covering:

• Happy path and full response contract
• Authorisation (403 for unauthorised users)
• Scoping (no cross-project leakage)
• Edge cases (no activity, sparse activity, streak logic)
• 404 for non-existent project

Test Environment Fix

• Updated test.rb to allow Rack::Test host (example.org)
• Prevents HostAuthorization from blocking test requests

How to Test

• Run: bundle exec rails test test/api/projects_api_test.rb -n /engagement_heatmap/

• Then call: GET /api/projects/:id/engagement_heatmap and verify the response includes:

• project_id

• unit_id

• range

• days (84 entries)

• summary

Notes / Limitations

• Fixed 84-day window (no query params yet).
• Uses server timezone for daily bucketing.
• tasks_completed counts distinct tasks with at least one "Complete" engagement.
• Streak ends today (or yesterday if today has no activity), bounded by the 84-day window.