fix: require deck_id on Card response schema - #92

cards.deck_id is NOT NULL in the model and the database after #91, so Card.deck_id in the API schema should be required instead of PositiveInt | None = None.

Card was also the body type of PUT /api/decks/{deck_id}/cards/, where the deck comes from the path and the repository already dropped any body deck_id. Making the field required would have made every PUT fail validation, so the body now uses a new CardUpdate (front, back, hint, id). Card extends it with the required deck_id and is used for responses only. upsert_cards no longer needs exclude={"deck_id"}.

Tests: a new OpenAPI test asserts deck_id is required on Card. It failed before the change. Ruff, ty and pytest (100% coverage) pass against Postgres 14.