feat: fase 5 — botones volver, seguridad APIs, infraestructura

- Botón 'Volver' en todas las sesiones de ejercicios (ExerciseSession)
- Botón 'Cambiar perfil' en las 3 home pages (Isabella/Francesca/Sebastián)
- Páginas inline de Isabella migradas a ExerciseSession (elimina código duplicado)
- APIs con try/catch: curriculum/next, dashboard/summary, fsrs/next, children
- Validación childId en curriculum/next (404 si no existe)
- /api/health endpoint para Docker healthcheck
- .env.example, .dockerignore, README.md creados
- docker-compose.yml con healthcheck en app service
- Test E2E: health endpoint + childId validation
- 62/62 tests pasan, TS exit 0

lib/validate-child.ts

@@ -0,0 +1,19 @@
+import { prisma } from "@/lib/db"
+
+/**
+ * Validates that a childId exists in the database.
+ * Returns the child record or null.
+ * Use this in API routes to prevent access to non-existent children.
+ */
+export async function validateChild(childId: string | null) {
+  if (!childId) return null
+  try {
+    const child = await prisma.child.findUnique({
+      where: { id: childId },
+      select: { id: true, name: true, profile: true, familyId: true },
+    })
+    return child
+  } catch {
+    return null
+  }
+}