Sub-modules phase A: additive DB models and constraints

Part of the shared-curriculum sub-modules umbrella (#396), phase A of 4. Full design: _docs/planning/shared-curriculum-submodules-design.md (sections "Refined design" and "Constraints and what the renderers must know").

Goal

Additive-only database schema for shared-curriculum sub-modules and per-cohort homework anchoring. No behavior change for any existing content — every module currently has zero sub-modules and must keep rendering exactly as today.

Scope

1. New model courses.models.shared_curriculum.SharedSubModule: required FK to SharedModule (related_name="sub_modules"), position (int), slug, title, summary (optional), source provenance fields mirroring SharedModule's own (source_content_id etc.). No overview_markdown, no independent published/retired_at — a sub-module is a grouping, not an independently-publishable unit. Unique constraints: (module, position), (module, slug), (module, source_content_id).
2. SharedLesson gains a nullable sub_module FK. clean() validates sub_module.module_id == module_id when set.
3. CohortSharedModule gains a nullable sub_module FK (the homework anchor selector) and:
   • UniqueConstraint(fields=("cohort", "shared_module"), condition=Q(sub_module__isnull=True))
   • UniqueConstraint(fields=("cohort", "sub_module"), condition=Q(sub_module__isnull=False))
   • UniqueConstraint(fields=("terminal_homework",), condition=Q(terminal_homework__isnull=False))
   • clean(): sub_module.module_id == shared_module_id when sub_module is set.
   • Update the model's docstring: a placement is one cohort's homework anchor on one node (module or one of its sub-modules) of a shared module — not merely "optional."
4. Migrations: purely additive (new table, new nullable columns, new constraints on existing tables — verify the three new CohortSharedModule constraints don't reject any existing row; they shouldn't, since every existing row has sub_module IS NULL).
5. Django admin: register SharedSubModule with reasonable list/search config, consistent with how SharedModule is already registered.

Non-goals

• No importer/parser changes (phase B).
• No rendering changes (phase C).
• No zoomcamp-ops/module.yaml/cohort.yaml schema changes (phase D).
• No real sub-module data — this phase ships with zero SharedSubModule rows in every environment.

Dependencies

• Depends on: none.
• Blocks: #397 (phase B), which needs these models to exist.

Acceptance criteria

• make django-check / make migrations-check pass.
• make test (full suite) passes with zero behavior change to any existing rendered page (verify by diffing rendered HTML for a couple of real shared-curriculum pages before/after, e.g. an llm-zoomcamp module page).
• New model tests: SharedSubModule uniqueness constraints, SharedLesson.clean() cross-module rejection, CohortSharedModule.clean() cross-module rejection, all three new CohortSharedModule constraints (module-level dup rejected, sub-module-level dup rejected, a homework anchored twice rejected).
• manage.py migrate applies cleanly end to end on a fresh database and on the existing local dev database; migration reverses cleanly.
• Django admin renders SharedSubModule without error.

Read _docs/planning/shared-curriculum-submodules-design.md, especially the “Refined design” and “Constraints and what the renderers must know” sections, then inspect the existing SharedModule, SharedLesson, CohortSharedModule, and Django admin definitions. Implement only the additive models, fields, validation, constraints, migrations, admin registration, and tests described. Done means the Django checks, migration checks, full suite, fresh and existing migrations, reversal, and admin rendering pass without rendering changes.