let a finished island quiz open the next island, and ground ask-AI in the student's book

The frontend plays node quizzes, but a node only completed once every one of its
8-13 lessons was completed separately, so students were stuck after the first
island of each unit. POST /api/nodes/{id}/quiz/complete now completes the node
(any score; score only sets stars/xp) and returns nextNodeId.

Also closes the other backend gaps found while auditing the frontend:
- /api/ai/ask without lessonId now picks the book from the user's grade instead
  of skipping retrieval, so the "ask Pi" tab is grounded in the textbook.
- guest sessions return a refreshToken; they used to go silently 401 after 1h.
- lesson_complete throttle 10/hour -> 120/hour (a lesson here is 1-2 questions).
- progressPercent is per grade, not over all 2,617 lessons of every grade.
- a one-year plan (299,000 toman) is created by migration when no plan exists.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

CLAUDE.md

@@ -237,6 +237,12 @@ quiz; `questionCount` is reported separately from `requested` so a thin node can
 like an error. 224 of 263 nodes hold a full four-question quiz, and every node in
 grades 8–12 does; the 39 that fall short are all in grades 3/6/7.
 
+Finishing the quiz finishes the island: `POST /api/nodes/{id}/quiz/complete` marks the node
+completed whatever the score (the owner's call on 2026-09-24: keep it simple) and returns
+`nextNodeId`. Before it existed, a node only completed when every one of its 8–13 lessons
+was completed one by one, so a student playing node quizzes was stuck after the first
+island of every unit. Details in `docs/architecture.md`.
+
 ## AI provider notes
 
 `OPENAI_BASE_URL` points at GapGPT (an OpenAI proxy reachable from Iran) and it exposes