Phase 6b/7b: dashboard codes editor, decode events, human-readable briefs (AUD-115)

- New /codes dashboard page (behind the session login, linked in the top bar):
  lists every mapping by kind with Add, inline Edit+Save and Delete. Sam can put
  real teacher surnames in without a rebuild (FR-17).
- Decode timetable EVENTS through the same map as periods, so an ensemble reads
  'JAZZ ENSEMBLE - Ensemble Room - Mr KWO' instead of raw codes.
- teacherName splits comma- or space-separated codes ('HHL, OFG').
- SeedCodes is a one-time bootstrap while the table is empty, so a correction or
  a delete is never overwritten or restored.
- Tests: decode Label/Event, the /codes page (save, refuse, csrf, delete, auth),
  store re-seed behaviour. go test ./internal/... passes.

internal/brief/brief.go

@@ -138,14 +138,15 @@ func (s *Service) ChildrenText(ctx context.Context, child store.Child) (string,
 	return notice + "\n" + text, false, nil
 }
 
-// decoder loads the editable codes map and returns the lesson-title decoder the
-// brief uses (FR-17). An unknown code renders raw, never blank.
+// decoder loads the editable codes map and returns the label decoder the brief
+// uses (FR-17). It decodes lesson periods and timetable events; an unknown code
+// renders raw, never blank.
 func (s *Service) decoder(ctx context.Context) (func(string) string, error) {
 	codes, err := s.Store.Codes(ctx)
 	if err != nil {
 		return nil, fmt.Errorf("decode map: %w", err)
 	}
-	return func(title string) string { return decode.Period(title, codes) }, nil
+	return func(title string) string { return decode.Label(title, codes) }, nil
 }
 
 // CombinedText returns the single brief for Jo and Sam — both boys in one