Slim API deployment - composer install + full CRUD endpoints

www/fahrschultermin.de/app/Http/Controllers/AppointmentsController.php

@@ -96,6 +96,11 @@ final class AppointmentsController
 
         $student = null;
         if (!empty($payload['student_id'])) {
+            // Reject student_id if lesson_type does not allow it
+            if ((int) $lessonType['allows_student'] !== 1) {
+                Response::json(['message' => 'Bei dieser Stundenart kann kein Fahrschüler ausgewählt werden'], 422);
+            }
+
             $student = (new StudentRepository())->find($tenantId, (int) $payload['student_id']);
             if ($student === null) {
                 Response::json(['message' => 'Unbekannter Fahrschueler'], 422);
@@ -154,6 +159,7 @@ final class AppointmentsController
             'units' => $units,
             'status' => $payload['status'] ?? 'planned',
             'notes' => $payload['notes'] ?? '',
+            'notes_private' => $payload['notes_private'] ?? '',
             'warning_acknowledged' => !empty($payload['warning_acknowledged']),
             'units_breakdown' => $unitsBreakdown,
         ];