feat: API wali murid (Sanctum) + verifikasi admin

- Pasang laravel/sanctum, routes/api.php (prefix api/v1, 10 endpoint)
- Migrasi: parent_name di students, parent_students (pivot wali↔anak),
  parent_devices (token FCM), permission parents-verify
- Auth wali: registrasi NISN+HP (auto-verify jika HP cocok data siswa,
  pending jika tidak) + login token Sanctum
- Endpoint: me, logout, students, link anak, violations, sp-letters,
  notifications, register device
- Halaman admin Verifikasi Wali (approve/reject) + menu sidebar
- Sync kesiswaan: tarik data orang tua (student_parents) ke students
- 8 feature test baru (ParentApiTest) — total suite 39 test hijau

routes/api.php

@@ -0,0 +1,40 @@
+<?php
+
+use App\Http\Controllers\Api\ParentAuthController;
+use App\Http\Controllers\Api\ParentNotificationController;
+use App\Http\Controllers\Api\ParentStudentController;
+use Illuminate\Support\Facades\Route;
+
+/*
+|--------------------------------------------------------------------------
+| API Routes — Aplikasi Wali Murid (Mobile iOS & Android)
+|--------------------------------------------------------------------------
+| Base URL: https://tatib.smkn1-wonorejo.sch.id/api/v1
+| Auth: Laravel Sanctum (Bearer token)
+*/
+
+// ===== Publik: registrasi & login wali murid =====
+Route::post('/parent/register', [ParentAuthController::class, 'register'])
+    ->middleware('throttle:5,1')
+    ->name('api.parent.register');
+
+Route::post('/parent/login', [ParentAuthController::class, 'login'])
+    ->middleware('throttle:10,1')
+    ->name('api.parent.login');
+
+// ===== Terproteksi: Bearer token =====
+Route::middleware('auth:sanctum')->prefix('parent')->group(function () {
+    // Akun
+    Route::get('/me', [ParentAuthController::class, 'me'])->name('api.parent.me');
+    Route::post('/logout', [ParentAuthController::class, 'logout'])->name('api.parent.logout');
+
+    // Anak (wali)
+    Route::get('/students', [ParentStudentController::class, 'index'])->name('api.parent.students');
+    Route::post('/students/link', [ParentStudentController::class, 'link'])->middleware('throttle:5,10')->name('api.parent.students.link');
+    Route::get('/students/{student}/violations', [ParentStudentController::class, 'violations'])->name('api.parent.students.violations');
+    Route::get('/students/{student}/sp-letters', [ParentStudentController::class, 'spLetters'])->name('api.parent.students.sp-letters');
+
+    // Notifikasi & perangkat
+    Route::get('/notifications', [ParentNotificationController::class, 'index'])->name('api.parent.notifications');
+    Route::post('/devices', [ParentNotificationController::class, 'registerDevice'])->name('api.parent.devices');
+});

routes/web.php

@@ -140,6 +140,12 @@ Route::middleware('auth')->group(function () {
         Route::get('/point-audit', [\App\Http\Controllers\Admin\PointAuditController::class, 'index'])->name('point-audit.index');
     });
 
+    Route::middleware('permission:parents-verify')->group(function () {
+        Route::get('/parents/verification', [\App\Http\Controllers\Admin\ParentVerificationController::class, 'index'])->name('parents.verification');
+        Route::post('/parents/verification/{link}/approve', [\App\Http\Controllers\Admin\ParentVerificationController::class, 'approve'])->name('parents.verification.approve');
+        Route::post('/parents/verification/{link}/reject', [\App\Http\Controllers\Admin\ParentVerificationController::class, 'reject'])->name('parents.verification.reject');
+    });
+
     // ===== Administrasi (permission-based) =====
     Route::middleware('permission:settings-manage')->group(function () {
         Route::get('/settings', [SettingsController::class, 'index'])->name('settings.index');