feat: implement 33 nice-to-have features + fix 37 code review bugs

5 SDD batches archived:
- Batch 1: UI Polish (10 features, 14 tasks)
- Batch 2: Study System (8 features, 23 tasks)
- Batch 3: Infrastructure (5 features, 22 tasks)
- Batch 4: AI Advanced (5 features, 30 tasks) — RAG with @xenova/transformers
- Batch 5: Core Features (5 features, 19 tasks)

37 bugs fixed from comprehensive code review (11 CRITICAL, 12 HIGH, 14 MEDIUM/LOW):
- SSE streaming now works (event.token check)
- API keys no longer exposed via GET /api/models
- FTS5 injection sanitized
- DB backup/restore with admin auth
- Buddy mode wired (buddy_meta column)
- Exam auto-submit stale closure fixed
- CSS variables aligned with design tokens
- Progress data corruption fixed
- WebSocket protocol auto-detection
- Tests infrastructure completed (vitest + node:test)

server/lib/sm2.js

@@ -0,0 +1,24 @@
+function sm2(prev, quality) {
+  let { ease_factor: e, interval_days: i, repetitions: r } = prev;
+  if (quality < 3) {
+    r = 0;
+    i = 1;
+  } else {
+    if (r === 0) i = 1;
+    else if (r === 1) i = 6;
+    else i = Math.round(i * e);
+    r += 1;
+  }
+  e = Math.max(1.3, e + (0.1 - (5 - quality) * (0.08 + (5 - quality) * 0.02)));
+  // next_review uses local timezone — acceptable for a personal study app
+  const next = new Date();
+  next.setDate(next.getDate() + i);
+  return {
+    ease_factor: +e.toFixed(2),
+    interval_days: i,
+    repetitions: r,
+    next_review: next.toISOString().slice(0, 10),
+  };
+}
+
+module.exports = { sm2 };