feat: implement 33 nice-to-have features + fix 37 code review bugs

5 SDD batches archived:
- Batch 1: UI Polish (10 features, 14 tasks)
- Batch 2: Study System (8 features, 23 tasks)
- Batch 3: Infrastructure (5 features, 22 tasks)
- Batch 4: AI Advanced (5 features, 30 tasks) — RAG with @xenova/transformers
- Batch 5: Core Features (5 features, 19 tasks)

37 bugs fixed from comprehensive code review (11 CRITICAL, 12 HIGH, 14 MEDIUM/LOW):
- SSE streaming now works (event.token check)
- API keys no longer exposed via GET /api/models
- FTS5 injection sanitized
- DB backup/restore with admin auth
- Buddy mode wired (buddy_meta column)
- Exam auto-submit stale closure fixed
- CSS variables aligned with design tokens
- Progress data corruption fixed
- WebSocket protocol auto-detection
- Tests infrastructure completed (vitest + node:test)

server/lib/broadcast.js

@@ -0,0 +1,26 @@
+let _wss = null;
+
+function setWss(wss) {
+  _wss = wss;
+}
+
+function broadcast(payload) {
+  if (!_wss) return;
+  const data = JSON.stringify(payload);
+  _wss.clients.forEach(ws => { if (ws.readyState === 1) ws.send(data); });
+}
+
+function broadcastBuddy(payload) {
+  if (!_wss) return;
+  _wss.clients.forEach((client) => {
+    if (client.readyState === 1) {
+      try {
+        client.send(JSON.stringify(payload));
+      } catch (err) {
+        console.error('[ws] buddy broadcast error:', err.message);
+      }
+    }
+  });
+}
+
+module.exports = { setWss, broadcast, broadcastBuddy };