feat: fase 5 — botones volver, seguridad APIs, infraestructura

- Botón 'Volver' en todas las sesiones de ejercicios (ExerciseSession)
- Botón 'Cambiar perfil' en las 3 home pages (Isabella/Francesca/Sebastián)
- Páginas inline de Isabella migradas a ExerciseSession (elimina código duplicado)
- APIs con try/catch: curriculum/next, dashboard/summary, fsrs/next, children
- Validación childId en curriculum/next (404 si no existe)
- /api/health endpoint para Docker healthcheck
- .env.example, .dockerignore, README.md creados
- docker-compose.yml con healthcheck en app service
- Test E2E: health endpoint + childId validation
- 62/62 tests pasan, TS exit 0

app/api/children/route.ts

@@ -3,55 +3,65 @@ import { prisma } from "@/lib/db"
 import { auth } from "@/lib/auth"
 
 export async function GET(request: NextRequest) {
-  const session = await auth.api.getSession({ headers: request.headers })
-  if (!session?.user?.id) {
-    return NextResponse.json({ error: "No autorizado" }, { status: 401 })
-  }
+  try {
+    const session = await auth.api.getSession({ headers: request.headers })
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: "No autorizado" }, { status: 401 })
+    }
 
-  const parent = await prisma.parent.findUnique({
-    where: { id: session.user.id },
-    include: {
-      family: {
-        include: { children: true },
+    const parent = await prisma.parent.findUnique({
+      where: { id: session.user.id },
+      include: {
+        family: {
+          include: { children: true },
+        },
       },
-    },
-  })
+    })
 
-  if (!parent || !parent.family) {
-    return NextResponse.json({ error: "Parent or family not found" }, { status: 404 })
+    if (!parent || !parent.family) {
+      return NextResponse.json({ error: "Parent or family not found" }, { status: 404 })
+    }
+
+    return NextResponse.json(parent.family.children)
+  } catch (error) {
+    console.error("[children GET] error:", error)
+    return NextResponse.json({ error: "Internal error" }, { status: 500 })
   }
-
-  return NextResponse.json(parent.family.children)
 }
 
 export async function POST(request: Request) {
-  const session = await auth.api.getSession({ headers: request.headers })
-  if (!session?.user?.id) {
-    return NextResponse.json({ error: "No autorizado" }, { status: 401 })
+  try {
+    const session = await auth.api.getSession({ headers: request.headers })
+    if (!session?.user?.id) {
+      return NextResponse.json({ error: "No autorizado" }, { status: 401 })
+    }
+
+    const { name, birthdate, profileNotes } = await request.json()
+    if (!name) {
+      return NextResponse.json({ error: "name required" }, { status: 400 })
+    }
+
+    const parent = await prisma.parent.findUnique({
+      where: { id: session.user.id },
+      select: { familyId: true },
+    })
+
+    if (!parent || !parent.familyId) {
+      return NextResponse.json({ error: "Parent has no family" }, { status: 400 })
+    }
+
+    const child = await prisma.child.create({
+      data: {
+        name,
+        birthdate: birthdate ? new Date(birthdate) : undefined,
+        profileNotes,
+        familyId: parent.familyId,
+      },
+    })
+
+    return NextResponse.json(child, { status: 201 })
+  } catch (error) {
+    console.error("[children POST] error:", error)
+    return NextResponse.json({ error: "Internal error" }, { status: 500 })
   }
-
-  const { name, birthdate, profileNotes } = await request.json()
-  if (!name) {
-    return NextResponse.json({ error: "name required" }, { status: 400 })
-  }
-
-  const parent = await prisma.parent.findUnique({
-    where: { id: session.user.id },
-    select: { familyId: true },
-  })
-
-  if (!parent || !parent.familyId) {
-    return NextResponse.json({ error: "Parent has no family" }, { status: 400 })
-  }
-
-  const child = await prisma.child.create({
-    data: {
-      name,
-      birthdate: birthdate ? new Date(birthdate) : undefined,
-      profileNotes,
-      familyId: parent.familyId,
-    },
-  })
-
-  return NextResponse.json(child, { status: 201 })
 }