fix(programs): clamp completed-session nextWeek to program max week

[evan188199-tech]

What

Completing a program session out of order could write a currentWeek that doesn't exist in the program, stranding the user on an empty "ghost week".

Bug found while auditing the programs API — not covered by any existing issue/PR.

Reproduction

Program: 2 weeks (W1: 2 sessions, W2: 2 sessions). Complete W2/S2 while W2/S1 is still incomplete (out-of-order completion, which the app otherwise supports).

Both complete-program-session.action.ts and app/api/programs/session-progress/[progressId]/complete/route.ts share this wrap (duplicated verbatim):

if (nextSession > currentWeekSessions) {
  nextWeek = currentWeek + 1;   // never clamped
  nextSession = 1;
}

For currentWeek=2, currentSession=2, completed count 1 < total 4 → isCompleted=false:

{ isCompleted: false, nextWeek: 3, nextSession: 1 }   // program only has weeks 1–2!

The enrollment is saved currentWeek=3, and on the program page setSelectedWeek(progress.stats.currentWeek) selects week 3 — which has no sessions. The user is stuck on an empty week (resume pointer permanently wrong until enough sessions flip isCompleted).

Fix

Clamp the week increment to the program's last week:

const maxWeek = Math.max(...enrollment.program.weeks.map((w) => w.weekNumber));
if (nextSession > currentWeekSessions) {
  nextWeek = Math.min(currentWeek + 1, maxWeek);
  nextSession = 1;
}

When the program is genuinely done, isCompleted already guards the write. Verified against the repro: out-of-order completion now lands on week 2 / session 1 (a real week) instead of week 3. Fixed in both copies.

Fixes #232.

[vercel]

Someone is attempting to deploy a commit to the Workoutcool Team Team on Vercel.

A member of the Team first needs to authorize it.

[evan188199-tech]

此 PR 由 GLM-5.2 修复。