Report question: skip a broken card and tell the server

A generated matching card arrived on a phone with three identical
definitions (the generation guards now drop those), but there was no way
to get past a bad card from inside a session. The feed chrome (deck
study, review, mistakes and exam) now has the red "!" control: one tap
records the question, skips to the next card and shows an Undo toast.

- lib/question-reports.ts: the local list (freezmo.reports.v1, zod on
  read, capped 200) is the skip state — reported cards leave every
  session type, count as "not attempted" in the results instead of
  wrong, and Undo takes a report back. A deck where everything is
  reported stays studiable so it can be regenerated.
- POST /api/reports appends one JSON line per report to
  REPORTS_DIR/reports.jsonl (shared/freezmo/reports in production, the
  dev data dir in dev). Deliberately write-only: the question text is
  readable on the server (that is the point — prompt tuning) but never
  over HTTP, since the app has no auth. Best effort: offline reports stay
  local.
- The button: a red outlined rounded square with "!", the chrome's
  control size, in both feed headers (hidden on the results slide).
- config: REPORTS_DIR + RATE_LIMIT_REPORTS (20); the deploy creates the
  shared reports dir; the dev unit and AGENTS.md note the new server
  data location.
- Suites: phase-1 (append + validation + no GET), phase-2 (button, toast,
  server POST, local copy, skip counter, hidden next session, Undo, exam
  pool). SW -> freezmo-v38.

tests/phase2-test.mjs

@@ -123,6 +123,58 @@ const browser = await launchBrowser();
   await context.close();
 }
 
+/* 1c. report question: skips, records, hides, undo ------------------- */
+{
+  const { context, page } = await makePage(browser);
+  const posts = [];
+  await page.route("**/api/reports", (route) => {
+    posts.push(JSON.parse(route.request().postData() ?? "{}"));
+    return route.fulfill({ status: 200, contentType: "application/json", body: JSON.stringify({ ok: true }) });
+  });
+  await seed(page, { decks: [DECK] });
+  await page.goto(`${BASE}/deck/seed_deck`, { waitUntil: "networkidle" });
+  await page.waitForTimeout(1000);
+
+  const report = page.getByRole("button", { name: "Report question" });
+  check("report: button sits in the feed chrome", await report.isVisible());
+  await report.click();
+  await page.waitForTimeout(700);
+  check("report: toast with Undo", await page.getByText("Question reported").isVisible());
+  check(
+    "report: sent to the server",
+    posts.length === 1 && posts[0].activityId === "a1" && posts[0].question.includes("What colour"),
+    JSON.stringify(posts[0] ?? {}).slice(0, 80),
+  );
+  const stored = await page.evaluate(() => JSON.parse(localStorage.getItem("freezmo.reports.v1") ?? "[]"));
+  check("report: kept locally", stored.length === 1 && stored[0].activityId === "a1");
+  check("report: skips to the next activity", await page.getByText("2/2").isVisible());
+
+  // A fresh session leaves the reported question out.
+  await page.goto(`${BASE}/deck/seed_deck`, { waitUntil: "networkidle" });
+  await page.waitForTimeout(1000);
+  check(
+    "report: hidden in the next session",
+    (await page.getByText("What colour is a clear daytime sky?").count()) === 0 &&
+      (await page.getByText("What makes the sky blue?").count()) >= 1,
+  );
+
+  // Undo takes a report back (the earlier one stays).
+  await page.goto(`${BASE}/deck/seed_deck`, { waitUntil: "networkidle" });
+  await page.waitForTimeout(900);
+  await page.getByRole("button", { name: "Report question" }).click();
+  await page.waitForTimeout(400);
+  const before = await page.evaluate(() =>
+    JSON.parse(localStorage.getItem("freezmo.reports.v1") ?? "[]").map((report) => report.activityId),
+  );
+  await page.getByRole("button", { name: "Undo" }).click();
+  await page.waitForTimeout(300);
+  const after = await page.evaluate(() =>
+    JSON.parse(localStorage.getItem("freezmo.reports.v1") ?? "[]").map((report) => report.activityId),
+  );
+  check("report: Undo takes the report back", before.includes("a2") && !after.includes("a2") && after.includes("a1"), JSON.stringify({ before, after }));
+  await context.close();
+}
+
 /* 2. SRS due → review session; stats screen -------------------------- */
 {
   const now = Date.now();
@@ -164,6 +216,32 @@ const browser = await launchBrowser();
   await context.close();
 }
 
+/* 2b. review and exam leave reported questions out ------------------- */
+{
+  const { context, page } = await makePage(browser);
+  await page.addInitScript(() => {
+    localStorage.setItem(
+      "freezmo.reports.v1",
+      JSON.stringify([
+        { deckId: "seed_deck", activityId: "a1", type: "multiple_choice", question: "What colour is a clear daytime sky?", at: Date.now() },
+      ]),
+    );
+  });
+  await seed(page, { decks: [DECK] });
+  await page.goto(`${BASE}/exam`, { waitUntil: "networkidle" });
+  await page.waitForTimeout(900);
+  await page.getByRole("button", { name: /Sky deck/ }).click();
+  await page.waitForTimeout(200);
+  await page.getByRole("button", { name: /Start exam/ }).click();
+  await page.waitForTimeout(1000);
+  check(
+    "exam: reported question is out of the pool",
+    (await page.getByText("What colour is a clear daytime sky?").count()) === 0 &&
+      (await page.getByText("What makes the sky blue?").count()) >= 1,
+  );
+  await context.close();
+}
+
 /* 3. exam mode: setup, no hints, timer, breakdown -------------------- */
 {
   const { context, page } = await makePage(browser);