Report question: skip a broken card and tell the server

A generated matching card arrived on a phone with three identical
definitions (the generation guards now drop those), but there was no way
to get past a bad card from inside a session. The feed chrome (deck
study, review, mistakes and exam) now has the red "!" control: one tap
records the question, skips to the next card and shows an Undo toast.

- lib/question-reports.ts: the local list (freezmo.reports.v1, zod on
  read, capped 200) is the skip state — reported cards leave every
  session type, count as "not attempted" in the results instead of
  wrong, and Undo takes a report back. A deck where everything is
  reported stays studiable so it can be regenerated.
- POST /api/reports appends one JSON line per report to
  REPORTS_DIR/reports.jsonl (shared/freezmo/reports in production, the
  dev data dir in dev). Deliberately write-only: the question text is
  readable on the server (that is the point — prompt tuning) but never
  over HTTP, since the app has no auth. Best effort: offline reports stay
  local.
- The button: a red outlined rounded square with "!", the chrome's
  control size, in both feed headers (hidden on the results slide).
- config: REPORTS_DIR + RATE_LIMIT_REPORTS (20); the deploy creates the
  shared reports dir; the dev unit and AGENTS.md note the new server
  data location.
- Suites: phase-1 (append + validation + no GET), phase-2 (button, toast,
  server POST, local copy, skip counter, hidden next session, Undo, exam
  pool). SW -> freezmo-v38.

tests/phase1-test.mjs

@@ -4,7 +4,7 @@
  * and usage-limit handling (client wiring + real server mapping against a stub
  * Ollama).
  */
-import { readFileSync } from "node:fs";
+import { mkdirSync, readFileSync, rmSync } from "node:fs";
 import http from "node:http";
 
 import {
@@ -476,5 +476,59 @@ async function openSettings(page) {
   }
 }
 
+/* 10. reports: appended as JSON lines, write-only over HTTP --------- */
+{
+  check("reports: app port free", !(await portInUse(3211)));
+  const reportsDir = new URL("./.tmp/reports-api", import.meta.url).pathname;
+  rmSync(reportsDir, { recursive: true, force: true });
+  mkdirSync(reportsDir, { recursive: true });
+  const app = spawnApp(3211, {
+    OLLAMA_BASE_URL: "http://127.0.0.1:11999",
+    OLLAMA_AUTH: "local",
+    OLLAMA_VERIFY_KEY: "false",
+    REPORTS_DIR: reportsDir,
+  });
+
+  try {
+    const up = await waitForHttp("http://127.0.0.1:3211/api/health");
+    check("reports: stub app is up", up);
+    if (up) {
+      const report = {
+        deckId: "seed_deck",
+        deckTitle: "Lidové čtení",
+        activityId: "a1",
+        type: "matching",
+        question: "Přiřaď postavy k jejich zařazení.",
+        at: Date.now(),
+      };
+      const accepted = await fetch("http://127.0.0.1:3211/api/reports", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(report),
+      });
+      check("reports: accepted", accepted.status === 200 && (await accepted.json()).ok === true, String(accepted.status));
+
+      const lines = readFileSync(`${reportsDir}/reports.jsonl`, "utf8").trim().split("\n");
+      const stored = JSON.parse(lines[lines.length - 1]);
+      check(
+        "reports: one JSON line with a server timestamp",
+        stored.activityId === "a1" && stored.question === report.question && typeof stored.receivedAt === "string",
+      );
+
+      const invalid = await fetch("http://127.0.0.1:3211/api/reports", {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ deckId: "x" }),
+      });
+      check("reports: invalid body rejected", invalid.status === 400, String(invalid.status));
+
+      const readBack = await fetch("http://127.0.0.1:3211/api/reports");
+      check("reports: write-only over HTTP (no GET)", readBack.status === 405, String(readBack.status));
+    }
+  } finally {
+    app.stop();
+  }
+}
+
 await browser.close();
 finish();