let a finished island quiz open the next island, and ground ask-AI in the student's book

The frontend plays node quizzes, but a node only completed once every one of its
8-13 lessons was completed separately, so students were stuck after the first
island of each unit. POST /api/nodes/{id}/quiz/complete now completes the node
(any score; score only sets stars/xp) and returns nextNodeId.

Also closes the other backend gaps found while auditing the frontend:
- /api/ai/ask without lessonId now picks the book from the user's grade instead
  of skipping retrieval, so the "ask Pi" tab is grounded in the textbook.
- guest sessions return a refreshToken; they used to go silently 401 after 1h.
- lesson_complete throttle 10/hour -> 120/hour (a lesson here is 1-2 questions).
- progressPercent is per grade, not over all 2,617 lessons of every grade.
- a one-year plan (299,000 toman) is created by migration when no plan exists.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

accounts/tests_guest_refresh.py

@@ -0,0 +1,41 @@
+"""
+مهمان هم refresh token می‌گیرد.
+
+قبلاً مهمان فقط توکنِ یک‌ساعته داشت؛ بعد از یک ساعت همه‌ی درخواست‌ها ۴۰۱
+می‌شدند و اپ که هنوز خودش را واردشده می‌دید، بی‌صدا خطا می‌خورد.
+"""
+from django.core.cache import cache
+from django.test import TestCase
+
+
+class GuestRefreshTokenTests(TestCase):
+    def setUp(self):
+        cache.clear()
+
+    def _guest(self, device='device-abc'):
+        return self.client.post(
+            '/api/auth/session', {'type': 'guest', 'deviceId': device},
+            content_type='application/json',
+        ).json()
+
+    def test_guest_session_returns_a_refresh_token(self):
+        body = self._guest()
+        self.assertTrue(body['refreshToken'])
+
+    def test_the_refresh_token_renews_the_same_guest(self):
+        body = self._guest()
+
+        renewed = self.client.post(
+            '/api/auth/refresh', {'refreshToken': body['refreshToken']},
+            content_type='application/json',
+        )
+
+        self.assertEqual(renewed.status_code, 200)
+        profile = self.client.get(
+            '/api/user/profile', HTTP_AUTHORIZATION=f"Bearer {renewed.json()['token']}",
+        ).json()
+        self.assertEqual(profile['userId'], body['userId'])
+        self.assertTrue(profile['isGuest'])
+
+    def test_each_guest_session_gets_its_own_refresh_token(self):
+        self.assertNotEqual(self._guest()['refreshToken'], self._guest()['refreshToken'])