Add Obsidian Toolbox — 4 syntax generators under /tools

Inside-LMS toolbox for registered students: callout-CSS, YAML-frontmatter,
theme CSS-variables, Style Settings generators. Auth inherited from (student)
route group; no public surface, no email gate.

- Pure generators in src/lib/tools/* with Vitest (33 tests)
- Shared YAML-safe scalar quoter (_shared/yaml.ts) used by frontmatter +
  style-settings: unquoted user input was silently breaking YAML (tags '#x'
  -> null, color default '#7C3AED' -> null, 'a: b' -> parse error)
- hex validation in callout (no NaN), date input constrained, clipboard +
  analytics calls guarded
- Prisma ToolUsage model + migration; logToolUsage Server Action (auth-first,
  10-min dedup window per user/tool)
- Tool index /tools + ToolCard (explicit lucide map, no import *) + header link

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/lib/actions/tool-usage.ts

@@ -0,0 +1,25 @@
+"use server";
+import { headers } from "next/headers";
+import { auth } from "@/lib/auth";
+import { prisma } from "@/lib/prisma";
+import { TOOL_IDS, type ToolId } from "@/lib/tools/_shared/types";
+
+// Дедуп-окно: один (userId, tool) пишем раз в N минут — чистит аналитику и
+// снимает storage-abuse (Server Action — публичный RPC, не покрыт Better Auth rateLimit).
+const DEDUP_WINDOW_MS = 10 * 60 * 1000;
+
+export async function logToolUsage({ tool }: { tool: ToolId }): Promise<{ ok: boolean }> {
+  // auth-first: сессия раньше валидации ввода
+  const session = await auth.api.getSession({ headers: await headers() });
+  if (!session) return { ok: false };
+  if (!TOOL_IDS.includes(tool)) return { ok: false };
+
+  const recent = await prisma.toolUsage.findFirst({
+    where: { userId: session.user.id, tool, createdAt: { gte: new Date(Date.now() - DEDUP_WINDOW_MS) } },
+    select: { id: true },
+  });
+  if (recent) return { ok: true };
+
+  await prisma.toolUsage.create({ data: { userId: session.user.id, tool } });
+  return { ok: true };
+}