Spike readiness: AI gets its own slice of threads, cheaper hot paths, classroom-friendly login

- /api/ai/ask: at most AI_MAX_CONCURRENT_PER_WORKER (12 of 32 threads) answers per worker;
  beyond that 503 assistant_busy + Retry-After before any quota is reserved. Without it a
  burst of questions (3-40 s each) took every thread and the map and quizzes queued behind.
  The slot is held until the stream is actually finished or closed.
- Answer submission 21 -> 14 queries, 15.4 -> 11.0 ms: one query for all choices, locked
  get_or_create for node progress and streak, and today's streak recorded once per day
  via the cache instead of a transaction per answer.
- /api/home 12.4 -> 8.6 ms: the user's completions are read by user_id instead of an IN list
  of ~600 lesson ids; the dict is returned directly (serializer stays the Swagger contract,
  HomeMatchesItsSerializerTests keeps them equal).
- otp_login per-IP 30 -> 300/hour: a class of 30 on one school Wi-Fi filled it; guessing is
  bounded per code and per phone.
- /api/health aiConcurrency.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

config/health.py

@@ -237,6 +237,12 @@ def _db_pool() -> dict:
     }
 
 
+def _ai_concurrency() -> dict:
+    from ai_tutor import concurrency
+
+    return {'maxPerWorker': concurrency.limit(), 'inFlightThisWorker': concurrency.in_flight()}
+
+
 def _db_pool_warnings(pool: dict) -> list[str]:
     if pool.get('state') == 'over_budget':
         return [
@@ -355,6 +361,8 @@ class HealthView(APIView):
             'traffic': _traffic(),
             'offsiteBackup': offsite,
             'dbPool': db_pool,
+            # جواب‌های هم‌زمانِ دستیار در workerی که این را جواب داد (ai_tutor/concurrency.py).
+            'aiConcurrency': _ai_concurrency(),
             'allowedOrigins': list(getattr(settings, 'CORS_ALLOWED_ORIGINS', [])),
             # IPای که throttle برای همین درخواست می‌بیند. باید IPِ عمومیِ خودِ
             # صدازننده باشد؛ اگر IPِ ArvanCloud یا nginx بود، NUM_PROXIES غلط