docs: bring README and docs current for v1.25

Reflect the v1.25 surface without touching the changelog or version
numbers.

- README highlights now cover the new clinical signals (respiratory
  rate, the opt-in PHQ-9 / GAD-7 mental-wellbeing self-checks with calm
  crisis handling, grip strength, pain score, waist / body measurements,
  longevity labs), the signal registry that wires each one across charts,
  correlations, the coach, FHIR, and the API at once, structured records
  (allergies, family history; immunizations noted out of scope), the
  opt-in environmental-context module, inbound document extraction
  (transcribe, never interpret), and the self-description posture (a
  record-keeping and wellness tool, not a medical device).
- ai-providers.md gains a "what the Coach is — and isn't" section: the
  non-diagnostic standard and the calm proactive morning check-in
  behaviour.
- mcp-capabilities.md notes that the new measurement signals reach the
  assistant through the existing metric and labs tools via the registry,
  that the mental-wellbeing instruments / records / documents are
  deliberately not exposed over MCP, and ties the grounding contract to
  the project-wide self-description standard.
- getting-started.md lists the environmental module's Open-Meteo egress
  as an opt-in outbound dependency.

docs/api/mcp-capabilities.md

@@ -28,7 +28,10 @@ them up front):
 4. **Data and context only.** The server ships facts; it never returns a
    diagnosis, clinical verdict, risk score, or treatment change. The
    assistant narrates the facts and leaves clinical judgement to the
-   user's clinician.
+   user's clinician. This mirrors HealthLog's project-wide self-description
+   standard: the app is a personal health record-keeping and wellness tool,
+   not a medical device, and nothing it surfaces — here or in the UI —
+   diagnoses or treats.
 
 Discover before fetching: call `list_metrics` (or read the
 `healthlog://measurements/inventory` resource) first to see what exists,
@@ -95,6 +98,19 @@ Every read tool is annotated read-only / non-destructive / idempotent /
 closed-world — the read-only guarantee is structural (only read tools are
 registered for a read session), and the annotation merely advertises it.
 
+The v1.25 clinical-signal additions reach the assistant through these same
+tools rather than new tool names: respiratory rate, grip strength, the 0–10
+pain score, and waist / body measurements appear via `list_metrics` →
+`get_metric_series` / `get_metrics`, and the longevity lab markers via
+`get_labs`. A new signal is declared once in the in-app signal registry and
+shows up across the metric tools, correlations, and the FHIR map together,
+so the MCP surface never advertises a signal the record can't return. The
+opt-in mental-wellbeing instruments (PHQ-9, GAD-7), the structured records
+(allergies, family history), and the inbound-document store are deliberately
+**not** exposed over MCP: the instrument answers are kept out of the
+assistant by design, and the document pipeline extracts facts for the user
+to confirm in-app rather than streaming them to a model.
+
 ## Resources
 
 Read-only context the assistant can attach alongside tool results. Like

docs/integrations/ai-providers.md

@@ -198,6 +198,30 @@ The Coach drawer surfaces a "Local" badge when generation resolves
 to the local provider, so users who pinned a local endpoint can see
 at a glance that their context stayed on the host.
 
+## What the Coach is — and isn't
+
+The Coach is an informational assistant that works from your own
+logged data. It is not a doctor, what it says is not medical advice,
+and it does not diagnose, prescribe, or change treatment — those
+boundaries are written into its system prompt as safety contracts, not
+left to chance. It describes patterns observationally ("your resting
+heart rate has been rising over 14 days"), never as a verdict about a
+named condition, and it defers diagnosis, dose, and drug-interaction
+questions to a healthcare professional. This is HealthLog's
+project-wide self-description standard: a personal health
+record-keeping and wellness tool, not a medical device. The same
+non-diagnostic framing governs the daily briefing, the insights, and
+every surface that turns your data into words.
+
+The Coach can also reach out proactively — a calm, once-a-day morning
+check-in when there is something genuine to surface (a recovery trend
+easing off, blood pressure running a touch high). The nudge is warm
+and localized, references the focus by category rather than quoting
+your own words back, and stays silent when there is nothing real to
+say or when you have engaged the Coach recently. It is an invitation,
+never a streak-guilt prompt, and it inherits the same non-diagnostic
+boundaries as the chat.
+
 ## Caching contract
 
 Two caches sit in front of every provider call so generation budgets

docs/self-hosting/getting-started.md

@@ -16,6 +16,10 @@ already installed, longer if a TLS-fronted public hostname is in scope
   hold a 1.5 GB upload in `/tmp` while it parses.
 - **Outbound HTTPS** to `ghcr.io` (image pulls) plus whichever
   integration endpoints you plan to enable (Withings, OpenAI, etc.).
+  The opt-in environmental-context module additionally reaches
+  `api.open-meteo.com` for weather and daylight; it stays off until you
+  enable it and set a home location, and every outbound call goes
+  through the SSRF-guarded egress wrapper.
 - **Optional but recommended:** a reverse proxy that terminates TLS
   and forwards to `http://localhost:3000` (Caddy, Traefik, Nginx
   Proxy Manager, Coolify, or bare Nginx — see `reverse-proxy.md`).