Seed the vendor catalogue into SQL and add an optional AI course advisor

Course metadata: a scan now gives every course a course_meta row from the
downloader's sidecar JSON when the folder has one, else from catalog_courses
matched by the folder name the downloader would create (folderKeyFor, a port
of ine.py's sanitize_name). tools/build-catalog-seed.php turns the INE export
into seeds/ine_catalog.sql, an idempotent patch that creates its own table and
upserts by id, so it can be applied to the live server before or after the
code and re-run freely. Course pages show the blurb, difficulty, vendor and
tags; search matches tags and blurbs; Settings reports how each course got its
details. Against the live library 163 of 179 courses match.

Course advisor, off by default: api/advisor.php answers "which course should I
take to learn X / what comes before Y" with courses from the library, in
order, plus vendor courses not yet downloaded. includes/ai_client.php is a
small curl wrapper for any OpenAI-format chat endpoint (DeepSeek V4 Flash by
default, no composer); the prompt is a byte-stable catalogue of the library so
the provider's prefix cache covers it. Every course id the model returns is
validated server-side, a bad JSON reply gets one retry then a plain-text
fallback, and a per-user daily cap with token counts lives in
advisor_requests. With AI_ENABLED false the app makes no outbound requests
and the box does not appear; users can also hide it per browser.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012enquL2RZdjy3D5AcKP5yx

config.example.php

@@ -40,3 +40,15 @@ define('CLIENT_IP_HEADER', '');
 // Errors are written to the PHP error log either way — this only controls what
 // the browser is told, so leave it false on anything publicly reachable.
 define('DEBUG', false);
+
+// ---- AI course advisor (optional) ----
+// The advisor is off unless AI_ENABLED is true AND AI_API_KEY is set. With it
+// off the app never makes an outbound request; everything else works as usual.
+// Any OpenAI-format chat endpoint works — the defaults target DeepSeek
+// (get a key at https://platform.deepseek.com/).
+define('AI_ENABLED', false);
+define('AI_API_KEY', '');
+define('AI_BASE_URL', 'https://api.deepseek.com');
+define('AI_MODEL', 'deepseek-v4-flash');
+// Questions each user may ask per rolling 24 hours (failed calls count too).
+define('AI_DAILY_LIMIT', 50);