Send Private Class Message

Ask the teaching staff something the rest of the class will not see — or, as staff, answer one.

WHO MAY SEND WHAT:

• A STUDENT sends a question. to_user_id is refused: they are asking whoever is teaching, not a named adult, and letting a student address one specific member of staff is the first half of a private channel we do not want to exist.
• STAFF may only REPLY, and only into a thread that a student already opened (to_user_id must name someone who has asked in this class). There is no way for a teacher to open a private thread with a student.

That asymmetry IS the safeguarding design, so it is enforced here and not in the UI. Students in a school class are often minors; a lane an adult can open is a back-channel, and a lane only a child can open is a help desk. Nothing is hidden either way: _may_read_class_private lets the school read every thread, during the class and afterwards.

Synchronous and boring on purpose — no data-channel publish, no push. See the lane comment above PRIVATE_ASK_MAX_CHARS.