feat: add recommended courses and quiz multiple attempts

- Add is_recommended field to Course model
- Add allow_multiple_attempts field to Quiz model
- Create RecommendedCoursesController for admin management
  - List all approved courses
  - Get course by ID
  - Toggle recommendation status
- Add is_recommended filter to CoursesService.ListCourses
- Add allow_multiple_attempts to quiz update and response types
- Update ChaptersLessonService.updateQuiz to support allow_multiple_attempts

Backend/src/controllers/RecommendedCoursesController.ts

@@ -0,0 +1,75 @@
+import { Body, Get, Path, Put, Request, Response, Route, Security, SuccessResponse, Tags } from 'tsoa';
+import { ValidationError } from '../middleware/errorHandler';
+import { RecommendedCoursesService } from '../services/RecommendedCourses.service';
+import {
+    ListApprovedCoursesResponse,
+    GetCourseByIdResponse,
+    ToggleRecommendedRequest,
+    ToggleRecommendedResponse
+} from '../types/RecommendedCourses.types';
+
+@Route('api/admin/recommended-courses')
+@Tags('Admin/RecommendedCourses')
+export class RecommendedCoursesController {
+
+    /**
+     * ดึงรายการคอร์สที่อนุมัติแล้วทั้งหมด (สำหรับจัดการคอร์สแนะนำ)
+     * List all approved courses (for managing recommendations)
+     */
+    @Get()
+    @Security('jwt', ['admin'])
+    @SuccessResponse('200', 'Approved courses retrieved successfully')
+    @Response('401', 'Unauthorized')
+    @Response('403', 'Forbidden - Admin only')
+    public async listApprovedCourses(@Request() request: any): Promise<ListApprovedCoursesResponse> {
+        const token = request.headers.authorization?.replace('Bearer ', '');
+        if (!token) {
+            throw new ValidationError('No token provided');
+        }
+        return await RecommendedCoursesService.listApprovedCourses();
+    }
+
+    /**
+     * ดึงรายละเอียดคอร์สตาม ID
+     * Get course by ID
+     * @param courseId - รหัสคอร์ส / Course ID
+     */
+    @Get('{courseId}')
+    @Security('jwt', ['admin'])
+    @SuccessResponse('200', 'Course retrieved successfully')
+    @Response('400', 'Course is not approved')
+    @Response('401', 'Unauthorized')
+    @Response('403', 'Forbidden - Admin only')
+    @Response('404', 'Course not found')
+    public async getCourseById(@Request() request: any, @Path() courseId: number): Promise<GetCourseByIdResponse> {
+        const token = request.headers.authorization?.replace('Bearer ', '');
+        if (!token) {
+            throw new ValidationError('No token provided');
+        }
+        return await RecommendedCoursesService.getCourseById(courseId);
+    }
+
+    /**
+     * เปลี่ยนสถานะคอร์สแนะนำ
+     * Toggle course recommendation status
+     * @param courseId - รหัสคอร์ส / Course ID
+     */
+    @Put('{courseId}/toggle')
+    @Security('jwt', ['admin'])
+    @SuccessResponse('200', 'Recommendation status updated successfully')
+    @Response('400', 'Only approved courses can be recommended')
+    @Response('401', 'Unauthorized')
+    @Response('403', 'Forbidden - Admin only')
+    @Response('404', 'Course not found')
+    public async toggleRecommended(
+        @Request() request: any,
+        @Path() courseId: number,
+        @Body() body: ToggleRecommendedRequest
+    ): Promise<ToggleRecommendedResponse> {
+        const token = request.headers.authorization?.replace('Bearer ', '');
+        if (!token) {
+            throw new ValidationError('No token provided');
+        }
+        return await RecommendedCoursesService.toggleRecommended(token, courseId, body.is_recommended);
+    }
+}