feat: fase 5 — botones volver, seguridad APIs, infraestructura

- Botón 'Volver' en todas las sesiones de ejercicios (ExerciseSession)
- Botón 'Cambiar perfil' en las 3 home pages (Isabella/Francesca/Sebastián)
- Páginas inline de Isabella migradas a ExerciseSession (elimina código duplicado)
- APIs con try/catch: curriculum/next, dashboard/summary, fsrs/next, children
- Validación childId en curriculum/next (404 si no existe)
- /api/health endpoint para Docker healthcheck
- .env.example, .dockerignore, README.md creados
- docker-compose.yml con healthcheck en app service
- Test E2E: health endpoint + childId validation
- 62/62 tests pasan, TS exit 0

e2e/api-curriculum.spec.ts

@@ -29,11 +29,11 @@ test.describe("Curriculum API", () => {
     expect(json.error).toContain("childId")
   })
 
-  test("curriculum/next accepts childId param", async ({ request }) => {
-    const res = await request.get("/api/curriculum/next?childId=any&topic=lectura")
-    expect(res.status()).toBe(200)
+  test("curriculum/next rejects non-existent childId", async ({ request }) => {
+    const res = await request.get("/api/curriculum/next?childId=nonexistent&topic=lectura")
+    expect(res.status()).toBe(404)
     const json = await res.json()
-    expect(json).toBeDefined()
+    expect(json.error).toContain("not found")
   })
 
   test("curriculum/grade missing fields returns 400", async ({ request }) => {
@@ -61,4 +61,12 @@ test.describe("Curriculum API", () => {
     const json = await res.json()
     expect(json.error).toContain("childId")
   })
+
+  test("health endpoint returns ok status", async ({ request }) => {
+    const res = await request.get("/api/health")
+    expect(res.status()).toBe(200)
+    const json = await res.json()
+    expect(json.status).toBe("ok")
+    expect(json.timestamp).toBeDefined()
+  })
 })