feat: fase 2+3 — expansion masiva multi-perfil + bug fixes + hardening

Fase 2 (expansion):
- Francesca: +6 etapas matematicas (5-10), +7 etapas lectura (3-9), +2 ortografia
- Sebastian: +8 etapas matematicas (4-11), +6 lectura, +3 historia, +3 geografia, +1 banderas
- Nuevas paginas: ortografia, lectura, geografia, matematicas
- ~900 ejercicios nuevos, paridad ~500 por perfil

Fase 3 (bug fixes + hardening):
- Fix: SessionLog auto-create en grade route
- Fix: engine cache (no borrar antes de revisar)
- Fix: FSRS cards actualizadas en flujo curriculum
- Fix: responseMs real (no hardcodeado 3000)
- Fix: options dentro de content en sebastian etapa-1
- Fix: trazo-letra consonantes crash
- Security: execFileSync anti-command-injection en TTS
- DB: 18 cascade deletes + indices + unique constraints
- APIs debug: reset, state, seed
- Docker: espeak-ng + prisma + user/group
- E2E: 23 tests nuevos (curriculum-flow.spec.ts)
- Code review: tailwind colors, middleware dev mode, eslint config

Verificado: tsc exit 0, build exit 0, 61 E2E tests pass

app/api/curriculum/grade/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from "next/server"
 import { prisma } from "@/lib/db"
+import { buildFsrsCard, gradeCard, skillCodeFromGrade } from "@/lib/fsrs"
 
 export async function POST(request: NextRequest) {
   try {
@@ -9,13 +10,16 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: "Missing required fields" }, { status: 400 })
     }
 
-    const sessionLog = await prisma.sessionLog.findFirst({
+    // Auto-create session log if none exists (so SkillAttempts are always stored)
+    let sessionLog = await prisma.sessionLog.findFirst({
       where: { childId },
       orderBy: { startedAt: "desc" },
     })
 
     if (!sessionLog) {
-      return NextResponse.json({ error: "No active session" }, { status: 400 })
+      sessionLog = await prisma.sessionLog.create({
+        data: { childId, startedAt: new Date() },
+      })
     }
 
     await prisma.skillAttempt.create({
@@ -31,6 +35,47 @@ export async function POST(request: NextRequest) {
       },
     })
 
+    // Update/create FSRS card so due-date sorting works in the engine
+    const existingCard = await prisma.fsrsCard.findFirst({
+      where: { childId, skillCode },
+    })
+
+    const grade = skillCodeFromGrade(correct, responseMs ?? 5000)
+    const baseCard = buildFsrsCard({
+      stability: existingCard?.stability,
+      difficulty: existingCard?.difficulty,
+      reps: existingCard?.reps,
+      lapses: existingCard?.lapses,
+      due: existingCard?.dueAt,
+    })
+
+    const { card: updatedCard } = gradeCard(baseCard, grade)
+
+    if (existingCard) {
+      await prisma.fsrsCard.update({
+        where: { id: existingCard.id },
+        data: {
+          dueAt: updatedCard.due,
+          stability: updatedCard.stability,
+          difficulty: updatedCard.difficulty,
+          reps: updatedCard.reps,
+          lapses: updatedCard.lapses,
+        },
+      })
+    } else {
+      await prisma.fsrsCard.create({
+        data: {
+          childId,
+          skillCode,
+          dueAt: updatedCard.due,
+          stability: updatedCard.stability,
+          difficulty: updatedCard.difficulty,
+          reps: updatedCard.reps,
+          lapses: updatedCard.lapses,
+        },
+      })
+    }
+
     return NextResponse.json({ success: true })
   } catch (error) {
     console.error("Curriculum grade error:", error)