feat(挑战): 做对之后可以加一条写法上的限制再做一遍，判题时记下谁做到了

借小丑牌的赌注档：同一道题加一条限制（「整首歌只用 1 次 print」）再做一遍，
给课上做得快的学生找事做（做完一节课的题，中位要空等 13 分钟）。
判定沿用 AST 规则，挑战配在 problem.challenges，做到的记在 challenge_success；
做对的提交顺手判一遍，挑战没做到也照样算做对。没过的规则带上是第几行。
0039 灌进第一批 56 道常用题的 73 条挑战，api 起来后拿历史上做对的代码补一遍谁已经做到了。
出题页能配挑战、从做对的代码里找候选；课堂看板的格子带上挑战状态。

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/api/src/routes/problem.ts

@@ -1,8 +1,10 @@
 import {
+  AST_SUPPORTED_LANGUAGES,
   isSqlProblem,
   normalizeLanguage,
   problemListSortSchema,
   problemTypeFilterSchema,
+  type ChallengeList,
   type ProblemAuthor,
   type ProblemDetail,
   type ProblemList,
@@ -28,9 +30,10 @@ import {
 } from "drizzle-orm"
 import { Hono } from "hono"
 
-import { optionalAuth, type AppEnv } from "../auth/middleware"
+import { optionalAuth, requireAuth, type AppEnv } from "../auth/middleware"
 import { db, schema } from "../db"
 import { astRequirements } from "../judge/ast"
+import { challengeList } from "../services/challenge"
 import { failure, success } from "../http"
 import { JudgeStatus } from "../judge/status"
 import {
@@ -340,6 +343,21 @@ problemRoutes.get("/problem-authors", async (c) => {
   return success(c, rows satisfies ProblemAuthor[])
 })
 
+/**
+ * 几道题的挑战：`?problems=1080,2020,4077&language=Python`。课堂条「这节课都做完了」一次要
+ * 一节课的几道，题目页只要当前这道。挑战按语言分，语言是学生编辑器里选的那种
+ */
+problemRoutes.get("/challenges", requireAuth, async (c) => {
+  const language = c.req.query("language") ?? ""
+  if (!AST_SUPPORTED_LANGUAGES.includes(language)) return success(c, [] satisfies ChallengeList)
+  const ids = (c.req.query("problems") ?? "")
+    .split(",")
+    .map((id) => id.trim())
+    .filter(Boolean)
+    .slice(0, 20)
+  return success(c, (await challengeList(c.get("user")!, ids, language)) satisfies ChallengeList)
+})
+
 problemRoutes.get("/problems/:displayId/similar", optionalAuth, async (c) => {
   const [target] = await db
     .select({ id: schema.problem.id })