Phase 4: Frontend-Core MVP — Decks, Cards, Study mit FSRS-Loop

Stack:
- Tailwind 4 via @tailwindcss/vite (oklch-Theme + Dark-Mode-Auto)
- marked + DOMPurify für Markdown (sanitized, SSR-Safe)
- Svelte 5 runes durchgängig ($state, $derived, $effect)
- @sveltejs/adapter-node für Production-Build

Infrastruktur:
- $lib/auth/dev-stub.svelte.ts: User-ID via sessionStorage (Phase 2
  ersetzt durch echtes JWT via @mana/shared-auth)
- $lib/api/{client,decks,cards,reviews}.ts: typed Fetch-Wrapper, ruft
  cards-api auf 3081 mit X-User-Id-Header
- $lib/stores/toasts.svelte.ts: Toast-Store mit info/success/warning/error
- $lib/markdown.ts: marked → DOMPurify-Pipeline
- $lib/components/{Header,ToastStack}.svelte: Layout-Shell

Routes:
- / → Dev-Login-Form oder Redirect zu /decks (wenn eingeloggt)
- /decks → Liste mit Color-Dot, Hover-Delete-Button
- /decks/new → Create-Form (Name, Beschreibung, Color-Picker)
- /decks/[id] → Detail mit Cards-Liste + dueCount + "Lernen"-Button
- /cards/new?deck=... → Type-Picker (basic|basic-reverse) +
  Side-by-Side Markdown-Editor mit Live-Preview
- /study → Übersicht aller Decks mit Due-Counts
- /study/[deckId] → Session-View mit Queue-Snapshot, Reveal/Grade,
  Hotkeys (Space/Enter=Reveal & Good, 1-4=Again/Hard/Good/Easy),
  INPUT-Skip im Keyboard-Handler

CORS auf cards-api für localhost-Origins + cardecky.mana.how.

Verifiziert:
- pnpm run type-check ✅ 4/4 packages, svelte-check 0 errors
- pnpm build (cards-web) ✅ adapter-node bundle 140 kB server,
  alle Routen bundled
- Tailwind-CSS inlined in SSR-HTML, oklch-Theme korrekt
- CORS-Preflight funktioniert (OPTIONS 204 mit korrekten Allow-*-Headers)
- Live-Smoke-Test gegen localhost:3081 (cards-api) + localhost:3082
  (cards-web): Beide laufen parallel, Web → API CORS-fetch grün

Outside scope (Phase 4):
- Card-Edit-Page (/cards/[id]/edit) — heute nur Create + Delete
- Settings/Account/Credits/DSGVO-Pages — Phase 9 (Polish)
- Anki-Import — Phase 8

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/src/lib/components/Header.svelte

@@ -0,0 +1,53 @@
+<script lang="ts">
+	import { page } from '$app/state';
+	import { devUser } from '$lib/auth/dev-stub.svelte.ts';
+</script>
+
+<header
+	class="sticky top-0 z-40 w-full border-b bg-[var(--color-card)] border-[var(--color-border)]"
+>
+	<div class="mx-auto flex max-w-6xl items-center justify-between px-4 py-3">
+		<a href="/" class="flex items-center gap-2 font-semibold">
+			<span
+				class="inline-flex h-7 w-7 items-center justify-center rounded bg-[var(--color-primary)] text-[var(--color-primary-fg)] text-sm"
+			>
+				C
+			</span>
+			<span>Cards</span>
+		</a>
+
+		<nav class="flex items-center gap-6 text-sm">
+			<a
+				href="/decks"
+				class="hover:text-[var(--color-primary)]"
+				class:font-medium={page.url.pathname.startsWith('/decks')}>Decks</a
+			>
+			<a
+				href="/study"
+				class="hover:text-[var(--color-primary)]"
+				class:font-medium={page.url.pathname.startsWith('/study')}>Lernen</a
+			>
+		</nav>
+
+		<div class="flex items-center gap-3 text-sm">
+			{#if devUser.id}
+				<span class="text-[var(--color-muted)]"
+					>{devUser.id}
+				</span>
+				<button
+					class="rounded border px-2 py-1 text-xs hover:bg-[var(--color-border)] border-[var(--color-border)]"
+					onclick={() => devUser.clear()}
+				>
+					Logout (dev)
+				</button>
+			{:else}
+				<button
+					class="rounded bg-[var(--color-primary)] px-3 py-1 text-[var(--color-primary-fg)]"
+					onclick={() => devUser.set(prompt('User-ID (dev):') ?? '')}
+				>
+					Login (dev)
+				</button>
+			{/if}
+		</div>
+	</div>
+</header>

apps/web/src/lib/components/ToastStack.svelte

@@ -0,0 +1,25 @@
+<script lang="ts">
+	import { toasts } from '$lib/stores/toasts.svelte.ts';
+</script>
+
+{#if toasts.items.length > 0}
+	<div class="fixed bottom-4 right-4 z-50 flex flex-col gap-2">
+		{#each toasts.items as t (t.id)}
+			<div
+				class="flex items-start gap-3 rounded-lg px-4 py-3 shadow-lg max-w-sm border bg-[var(--color-card)] border-[var(--color-border)]"
+				class:text-[var(--color-success)]={t.kind === 'success'}
+				class:text-[var(--color-warning)]={t.kind === 'warning'}
+				class:text-[var(--color-danger)]={t.kind === 'error'}
+			>
+				<span class="flex-1 text-sm">{t.message}</span>
+				<button
+					class="text-[var(--color-muted)] hover:text-[var(--color-fg)] text-lg leading-none"
+					onclick={() => toasts.dismiss(t.id)}
+					aria-label="Schließen"
+				>
+					×
+				</button>
+			</div>
+		{/each}
+	</div>
+{/if}