feat: implement 33 nice-to-have features + fix 37 code review bugs

5 SDD batches archived:
- Batch 1: UI Polish (10 features, 14 tasks)
- Batch 2: Study System (8 features, 23 tasks)
- Batch 3: Infrastructure (5 features, 22 tasks)
- Batch 4: AI Advanced (5 features, 30 tasks) — RAG with @xenova/transformers
- Batch 5: Core Features (5 features, 19 tasks)

37 bugs fixed from comprehensive code review (11 CRITICAL, 12 HIGH, 14 MEDIUM/LOW):
- SSE streaming now works (event.token check)
- API keys no longer exposed via GET /api/models
- FTS5 injection sanitized
- DB backup/restore with admin auth
- Buddy mode wired (buddy_meta column)
- Exam auto-submit stale closure fixed
- CSS variables aligned with design tokens
- Progress data corruption fixed
- WebSocket protocol auto-detection
- Tests infrastructure completed (vitest + node:test)

server/routes/__tests__/progress.test.js

@@ -0,0 +1,71 @@
+const { describe, it, before } = require('node:test');
+const assert = require('node:assert');
+const express = require('express');
+
+// Pre-populate require.cache so progress routes get mock dependencies
+// without loading the real index.js (which would start the server)
+// or the real db.js (which would need sql.js init).
+const broadcastCalls = [];
+const mockBroadcast = (payload) => broadcastCalls.push(payload);
+
+require.cache[require.resolve('../../index')] = {
+  id: require.resolve('../../index'),
+  filename: require.resolve('../../index'),
+  loaded: true,
+  exports: { broadcast: mockBroadcast },
+};
+
+const mockDbRow = { topic: 'math', exercises_done: 5, exercises_correct: 4, last_session: '2024-01-01', notes: '[]' };
+
+require.cache[require.resolve('../../db')] = {
+  id: require.resolve('../../db'),
+  filename: require.resolve('../../db'),
+  loaded: true,
+  exports: {
+    prepare: () => ({
+      run: () => ({ changes: 1, lastInsertRowid: 1 }),
+      get: () => mockDbRow,
+      all: () => [],
+    }),
+  },
+};
+
+const progressRoutes = require('../progress');
+
+function request(app, method, urlPath, body, headers = {}) {
+  return new Promise((resolve, reject) => {
+    const server = app.listen(0, '127.0.0.1', async () => {
+      const port = server.address().port;
+      try {
+        const res = await fetch(`http://127.0.0.1:${port}${urlPath}`, {
+          method,
+          body: body ? JSON.stringify(body) : undefined,
+          headers: { 'Content-Type': 'application/json', ...headers },
+        });
+        server.close(() => resolve(res));
+      } catch (err) {
+        server.close(() => reject(err));
+      }
+    });
+  });
+}
+
+describe('progress routes', () => {
+  let app;
+
+  before(() => {
+    app = express();
+    app.use(express.json());
+    app.use('/api/progress', progressRoutes);
+  });
+
+  it('PUT /api/progress/:topic triggers broadcast with progress_update', async () => {
+    broadcastCalls.length = 0;
+    const res = await request(app, 'PUT', '/api/progress/math', { correct: true });
+    assert.strictEqual(res.status, 200);
+    assert.strictEqual(broadcastCalls.length, 1);
+    assert.strictEqual(broadcastCalls[0].type, 'progress_update');
+    assert.ok(broadcastCalls[0].data);
+    assert.strictEqual(broadcastCalls[0].data.topic, 'math');
+  });
+});