feat: add flashcards and quick quiz

[fly1d]

What changed

• Add compact Flashcards and Quiz actions below the quick questions.
• Show one flashcard at a time with reveal, previous, next, and close controls.
• Show a multiple-choice quiz with immediate feedback, the correct answer, explanation, retry, and close controls.
• Reset study state for each new topic and hide controls when study data is missing or malformed.
• Keep icon-only controls accessible and preserve the compact desktop/mobile layout.

Closes #10

Risk

• Low: copy, styles, documentation, or isolated cleanup
• Medium: interaction, API response, or shared behavior
• High: fetching, security boundary, deployment, or data compatibility

Verification

• npm run ci passes locally
• I tested the main user path affected by this change
• I checked desktop/mobile layout when UI changed
• I added or updated tests for behavior changes
• I documented anything intentionally not tested

Verification notes:

All 17 local checks pass. Browser testing verified all three flashcards can be revealed and navigated, an incorrect quiz answer marks both the selected and correct choices, retry permits a correct answer, and the study panels close cleanly. Desktop and 390x844 mobile checks found no horizontal overflow or console warnings/errors.

Review and release

• The diff is focused and contains no unrelated changes
• Error, empty, loading, and recovery states were considered
• Security and privacy impact was considered
• Rollback is understood

Rollback plan:

Revert this PR. Topic analysis and follow-up questions remain available; only the optional client-side flashcard and quiz controls are removed. No migration, API, or dependency rollback is required.

[fly1d]

Code review completed with no blocking findings after the label-spacing fix. Verified: flashcard and quiz controls render only for validated bounded data; new analyses reset all study state; card navigation and quiz answers remain within validated bounds; dynamic content is escaped; icon-only controls have accessible names; malformed data fails closed; all 17 local checks and the latest GitHub Smoke pass; desktop and 390x844 browser checks cover reveal/navigation, incorrect/correct feedback, retry, overflow, and console errors.