fix: create GET /api/settings endpoint for student components to prevent 403 Forbidden crash

server.ts

@@ -659,6 +659,17 @@ app.post('/api/admin/students/:id/status', authenticateToken, requireAdmin, (req
   res.json({ success: true, status: student.subscriptionStatus });
 });
 
+// Student / Public System Settings
+app.get('/api/settings', authenticateToken, (req: AuthenticatedRequest, res: Response) => {
+  const db = loadDb();
+  const settings = db.settings || {};
+  res.json({
+    trialDurationDays: settings.trialDurationDays || 7,
+    helpText: settings.helpText || '',
+    enableBoleto: settings.enableBoleto !== false
+  });
+});
+
 // Admin System Settings
 app.get('/api/admin/settings', authenticateToken, requireAdmin, (req: AuthenticatedRequest, res: Response) => {
   const db = loadDb();

src/components/CourseUnlockModal.tsx

@@ -1,4 +1,4 @@
-import React, { useState } from 'react';
+import React, { useState, useEffect } from 'react';
 import { X, Check, CreditCard, QrCode, FileText, Sparkles, Loader2, Play } from 'lucide-react';
 import { Course } from '../types';
 
@@ -46,7 +46,7 @@ export default function CourseUnlockModal({ course, onClose, onSuccess, token }:
 
   useEffect(() => {
     if (token) {
-      fetch('/api/admin/settings', {
+      fetch('/api/settings', {
         headers: { 'Authorization': `Bearer ${token}` }
       })
         .then(res => res.json())

src/components/SubscriptionView.tsx

@@ -36,7 +36,7 @@ export default function SubscriptionView({ user, token, onStatusUpdate }: Subscr
   useEffect(() => {
     fetchSubscriptionDetails();
     if (token) {
-      fetch('/api/admin/settings', {
+      fetch('/api/settings', {
         headers: { 'Authorization': `Bearer ${token}` }
       })
         .then(res => res.json())