Collect an APAAR ID at first login, and show the upload preview's real values

[vikrantwiz02]

Backend counterpart: FusionIIIT/Fusion#1959, which adds the column and enforces it server-side. Needs that migration deployed first.

APAAR ID at first login

The first-login profile popup gains a required APAAR ID beside Aadhaar: digits only, capped and validated at twelve, prefilled from the record like every other field, and included in the submit payload.

It also joins the shared column definitions, so the admin student list and the upload preview can show it — and, importantly, so the save transform keeps it. transformDataForDatabase iterates STUDENT_FIELDS_CONFIG; without an entry there an uploaded APAAR value would be silently dropped on its way to the server.

The upload preview showed nothing

Every row rendered an empty badge, blank names and "N/A". Uploaded rows keep the spreadsheet's own headings (Institute Roll Number, Name, Father's Name, Full Address) while the table read student.rollNumber, student.name, student.fname, student.address. The row count and branch tally looked right only because that code already tried four spellings.

The cells now read through the shared getStudentFieldValue + STUDENT_TABLE_COLUMNS, which already list every spelling, so a 554-student preview shows real roll numbers, names, parents, addresses and institute emails. Branch Code falls back to the discipline column. Nine cases pin the mapping against a row captured verbatim from process_excel_upload.

Saving from that preview was impossible

validateBatchPrerequisites posted with only a Content-Type header — no token — so the gated endpoint always answered 403:

	result
no auth header (what the app sent)	403 You do not have permission…
with auth header	200 can_upload=True, existing=5, missing=0

Worse, the fallback only triggered when the response wasn't JSON, and that 403 is JSON — so the error body was read as batch data, data.can_upload_students came back undefined, and data.missing_batches.slice(0, 5) threw, aborting before the save. It now sends the token, falls back whenever the response is not ok, and reads missing_batches ?? [].

Also

A Badge inside a Text on the allocation summary put a <div> inside a <p>, which React warned about on every render; that line renders as <Text component="div"> now — same appearance, valid HTML, clean console.

Checks

417 tests pass (up from 408), lint:strict clean, build clean.