feat: fase 2+3 — expansion masiva multi-perfil + bug fixes + hardening

Fase 2 (expansion):
- Francesca: +6 etapas matematicas (5-10), +7 etapas lectura (3-9), +2 ortografia
- Sebastian: +8 etapas matematicas (4-11), +6 lectura, +3 historia, +3 geografia, +1 banderas
- Nuevas paginas: ortografia, lectura, geografia, matematicas
- ~900 ejercicios nuevos, paridad ~500 por perfil

Fase 3 (bug fixes + hardening):
- Fix: SessionLog auto-create en grade route
- Fix: engine cache (no borrar antes de revisar)
- Fix: FSRS cards actualizadas en flujo curriculum
- Fix: responseMs real (no hardcodeado 3000)
- Fix: options dentro de content en sebastian etapa-1
- Fix: trazo-letra consonantes crash
- Security: execFileSync anti-command-injection en TTS
- DB: 18 cascade deletes + indices + unique constraints
- APIs debug: reset, state, seed
- Docker: espeak-ng + prisma + user/group
- E2E: 23 tests nuevos (curriculum-flow.spec.ts)
- Code review: tailwind colors, middleware dev mode, eslint config

Verificado: tsc exit 0, build exit 0, 61 E2E tests pass

e2e/api-curriculum.spec.ts

@@ -39,21 +39,14 @@ test.describe("Curriculum API", () => {
   test("curriculum/grade missing fields returns 400", async ({ request }) => {
     const res = await request.post("/api/curriculum/grade", {
       data: {},
+      headers: { "Content-Type": "application/json" },
     })
     expect(res.status()).toBe(400)
     const json = await res.json()
     expect(json.error).toBe("Missing required fields")
   })
 
-  test("curriculum/grade validates required fields", async ({ request }) => {
-    const res = await request.post("/api/curriculum/grade", {
-      data: { childId: "test", exerciseId: "ex1", skillCode: "test" },
-      headers: { "Content-Type": "application/json" },
-    })
-    expect(res.status()).toBe(400)
-    const json = await res.json()
-    expect(json.error).toBe("No active session")
-  })
+
 
   test("curriculum/progress requires childId", async ({ request }) => {
     const res = await request.get("/api/curriculum/progress")