feat(flashcards): фаза 1 полировки — хоткеи, поиск, drag-reorder, честные интервалы

- study: хоткеи Space/стрелки=флип, 1-4/←→=оценка
- превью интервалов = точная копия серверного SM-2 (было враньё «<1 мин»)
- поиск/фильтр карточек внутри колоды
- drag-reorder карточек + endpoint PUT /decks/:id/reorder (requireOwnership)
- flashcard_decks добавлен в ALLOWED_TABLES requireOwnership
- эмодзи в empty-state → inline SVG .ic
- deleteCard: нативный confirm() → LS.confirm

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

backend/src/routes/flashcards.js

@@ -2,6 +2,7 @@ const express = require('express');
 const router  = express.Router();
 const fc      = require('../controllers/flashcardController');
 const { authMiddleware } = require('../middleware/auth');
+const { requireOwnership } = require('../middleware/ownership');
 
 router.use(authMiddleware);
 
@@ -14,6 +15,7 @@ router.delete('/decks/:id',            fc.deleteDeck);
 router.get   ('/decks/:id/cards',      fc.getCards);
 router.post  ('/decks/:id/cards',      fc.addCard);
 router.post  ('/decks/:id/cards/bulk', fc.addCardsBulk);
+router.put   ('/decks/:id/reorder',    requireOwnership({ table: 'flashcard_decks', ownerField: 'user_id' }), fc.reorderCards);
 router.get   ('/decks/:id/study',      fc.getStudySession);
 router.put   ('/cards/:id',            fc.updateCard);
 router.delete('/cards/:id',            fc.deleteCard);