Exercise 1: The Parent Picker — Possible Solution
====================================================================

// routes/admin.js
app.get('/api/pages/candidates', requireAuth, async (req, res) => {
  const excludeId = Number(req.query.exclude);
  const [rows] = await pool.query('SELECT id, full_path FROM pages WHERE id != ?', [excludeId]);
  res.json(rows);
});

<!-- admin page (excerpt) - a plain <input> filtering a <select> -->
<input id="filter" placeholder="Search pages..." />
<select id="parent-select">
  <% candidates.forEach(c => { %>
    <option value="<%= c.id %>"><%= c.full_path %></option>
  <% }); %>
</select>

<script>
  document.getElementById('filter').addEventListener('input', (e) => {
    const query = e.target.value.toLowerCase();
    document.querySelectorAll('#parent-select option').forEach((opt) => {
      opt.hidden = !opt.textContent.toLowerCase().includes(query);
    });
  });
</script>

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly excludes the page being edited from its own candidate
list via WHERE id != ? - reparenting a page under itself would
corrupt the tree - and correctly implements the same client-side
filtering convention every sibling course already used.