feat: serve the day, its index, the timeline and life events

Replace the day, timeline and life-event stubs with their implementations
(#613) and drop the not-implemented helper, its error code and its OpenAPI
response with the last stub.

loadDay reads one local day for every reader: the readings live inside the
record's own day window (never the UTC rollups), through the canonical-source
engine the mood sheet already uses (resolveDayReadings in linked-context.ts),
with the person's usual range over the 30 days before; the record sections
from their own tables, each in the storage form it speaks (an instant in the
local window, a date string with its own zone, a calendar date). A switched-off
module's section is not read; a section the grant does not cover is named
not_shared and not read.

The day, the day index and the new visit preparation (GET /api/day/notable)
are admitted on the readings and narrowed per section through
actingDomainVisibility, so a scoped grant sees exactly its sections. The
timeline and its readiness stay whole-record reads and narrow their lanes the
same way.

Notable days are deterministic keys: a three-month high or low with history
behind it, a first reading, and in the visit preparation a regular reading
that stopped. The timeline lays out spans and points from the owning tables,
standing items without a date, and series by zoom: months from the rollup
tier inside its five-year window and from one cached live query before it.
The readiness inventory rates each lane with one link per gap.

Life events are created, edited and soft-deleted as MANAGE verbs with audit
rows, encrypted at rest, and join the sharing guard and the handler matrix.
get_day reads a day for the Coach and the MCP endpoint without life events,
notes or document names; its step carries the date it read.

src/lib/http/not-implemented.ts

@@ -1,21 +0,0 @@
-/**
- * The answer a route gives while its contract exists and its body does not.
- *
- * A release built in parallel packages lands every new route as a stub first,
- * registered in the OpenAPI table with its final shape, so the route-coverage
- * and contract checks hold in every package's worktree from the start. The
- * stub authenticates exactly as the finished route will and then answers 501.
- *
- * Nothing may ship with a stub in it: the error-code catalogue check fails on
- * a listed code no route emits, so the code leaves the catalogue, and this
- * file with it, once the last stub is implemented.
- */
-import { apiError } from "@/lib/api-response";
-
-export const NOT_IMPLEMENTED_ERROR_CODE = "not_implemented";
-
-export function notImplemented() {
-  return apiError("Not implemented", 501, {
-    errorCode: NOT_IMPLEMENTED_ERROR_CODE,
-  });
-}