docs: the evening's queue, written down rather than carried

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TqXevQJhxFrM7jJg82cgZN

docs/TODO.md

@@ -231,6 +231,32 @@ Captured so nothing is lost while the article writing runs.
 - [ ] **High-yield / key-exam-info toggles** — mark spans and let the reader show
       or hide them.
 
+## Asked for on 2026-09-11 (evening), not yet done
+
+- [ ] **Boxed quiz player** — a viewport-height shell: fixed rail, fixed bottom
+      bar (Exit / Previous / Next), question scrolling in its own column, so the
+      page itself does not scroll. Structural change to QuizPage.
+- [ ] **Share dialog** — a proper one: session title, first question as a
+      preview, the link with Copy, and a few share targets. Currently a copy
+      button in the more-menu.
+- [ ] **Admin can turn sharing off site-wide** — one setting that disables
+      share links everywhere, for an institution that does not want them.
+- [ ] **Remove per-question share/unshare** — `Question.is_shared` and
+      `PATCH /questions/{id}/share`. Access is the admin-scoped grant tree now.
+      NOT a small delete: `bank_question_predicate` and
+      `shareable_question_predicate` are built on is_shared and decide who sees
+      which questions and what the recommendation denominators are. Needs its
+      own change with the visibility rules rewritten deliberately.
+- [ ] **Invite-only sign-up** — an admin switch plus generated invite codes,
+      with the registration form requiring one while it is on.
+- [ ] **Settings, properly** — the section list was a restructure, not the
+      revamp asked for. Wants: what belongs there decided first, then the
+      sign-up policy and invite codes, the site-wide sharing switch, and the
+      admin dashboard's contents folded in rather than linked out to.
+- [ ] **Comments backend still mounted** — the UI is gone and nothing calls
+      `/api/comments`. The router, model and table are still there; removing
+      them destroys whatever was written, so it is a deliberate decision.
+
 ## Loose ends
 
 - [ ] **Image thumbnails and caching** — you mentioned a tool from the ped-ai