[Dx-Alz-xD]

closes #550

duplicates

• unique index on subject + exam + slot + year in PaperRequest
• createPaperRequest now upserts, so a repeat request returns 200 with "this paper has already been requested" instead of adding a row. new requests still return 201 and are the only ones sent to posthog

validation

• the body is checked with zod before the db call. bad json, null, missing or blank fields, or a field that isn't a string now return 400 instead of 500
• exam has to be one of CAT-1, CAT-2, FAT, Model CAT-1, Model CAT-2, Model FAT. PaperRequest had no enum before, so an unknown exam like "midterm" was saved. the schema now has the same enum

tested against an in-memory mongodb by calling the route directly: repeat and padded-subject requests store one row, 20 identical requests sent at once give one 201 and one row, and every bad body above gets 400. on staging the same requests gave 201s for duplicates and unknown exams and 500s for non-string fields and bad json

before deploying: if the db already has duplicate requests, the unique index won't build until they're removed. the route still works and still dedupes in the meantime, mongoose just logs the failed index build. this keeps the oldest of each and removes the rest:

db.paperrequests.aggregate([
{ $sort: { createdAt: 1 } },
{ $group: { _id: { subject: "$subject", exam: "$exam", slot: "$slot", year: "$year" }, ids: { $push: "$_id" } } },
{ $match: { "ids.1": { $exists: true } } }
]).forEach(group => db.paperrequests.deleteMany({ _id: { $in: group.ids.slice(1) } }))