Wire the Lesson player to the cmi5 launch endpoint (frontend course-player)

[rubenvdlinde]

Follow-up to cmi5-xapi-lrs-ingest (openspec/changes/cmi5-xapi-lrs-ingest), task 5.2.

The backend cmi5/xAPI ingest half is now built: GET /api/lrs/launch-token (LrsController::launchToken) mints an RS256 launch JWT (or returns HTTP 503 when the key-pair is not yet provisioned), and POST /api/lrs/statements ingests xAPI statements with a server-stamped verified_actor_id.

The frontend has no cmi5 content-type branch yet: src/views/LessonPlayer.vue only renders sanitised HTML (v-html). This issue covers the frontend course-player work:

1. Add a cmi5 content-type branch to LessonPlayer.vue (or a dedicated player component).
2. Before opening the AU iframe/window, call GET /api/lrs/launch-token?lessonId=...&registrationId=...; if it returns 503, show a human-readable "cmi5 not available" state instead of a broken iframe.
3. Pass the returned launchToken to the AU per cmi5 §8 launch mechanics; the AU then POSTs xAPI statements to /api/lrs/statements with the token.

Explicitly out of scope for the ingest change to avoid silently expanding it.

Ref: openspec/changes/cmi5-xapi-lrs-ingest/tasks.md#task-5.2

---

Gemigreerd van Codeberg — oorspronkelijk Conduction/scholiq#50, geopend door rubenvdlinde op 2026-07-07.

[github-actions]

Thank you for opening this issue! It has been assigned to @rubenvdlinde for review.

What happens next:

1. A maintainer will review this issue and determine the appropriate action
2. If accepted, it may be converted into an OpenSpec change for structured development
3. You will be notified of any status changes

Triage labels:

• triage:accept-feature — accepted as a new feature
• triage:accept-bugfix — accepted as a bug fix
• triage:needs-info — more information needed
• triage:wontfix — will not be addressed
• triage:duplicate — duplicate of another issue