feat(nutrients): tell the account holder when a sync arrived but nothing landed

GET /api/nutrients now looks up the most recent nutrient.batch.ingest
audit row when the window is genuinely empty, and surfaces it as
lastAttempt only when that call landed nothing (inserted === 0 &&
updated === 0). A real success elsewhere is left alone, so an empty
window for an unrelated reason never gets reframed as a failure.

The lookup runs on the zero-rows path only, never on the happy path,
and stays counts-and-reason-codes only - no user-typed content, no
per-entry health values. The reason code never reaches the page as
text: each of the four closed skip reasons maps to its own human
sentence, and the two that have no useful action for the account
holder (unit_mismatch, upsert_failed) say plainly that the entries
couldn't be stored rather than inventing advice. day_invalid is the
one case worth naming a real cause for - a clock or time zone mismatch
on the sending side - without claiming it was a phone, since any
token holder can call this route.

This depends on AuditLog retention: cleanupOldAuditLogs prunes rows
past 365 days by default, so a dormant account's last failed attempt
can age out and the explanation silently reverts to the plain empty
state. Documented at the lookup for whoever next touches that job.

src/components/insights/nutrients/types.ts

@@ -29,7 +29,20 @@ export interface NutrientOverviewRow {
   daysWithData: number;
 }
 
+/**
+ * Non-null only when `nutrients` is empty AND the most recent
+ * `nutrient.batch.ingest` audit row shows a call that landed nothing —
+ * `topReason` is the most common of the closed skip-reason codes
+ * (`unit_mismatch` | `value_out_of_range` | `day_invalid` |
+ * `upsert_failed`) from that call.
+ */
+export interface NutrientLastIngestAttempt {
+  at: string;
+  topReason: string;
+}
+
 export interface NutrientIntakeOverview {
   windowDays: number;
   nutrients: NutrientOverviewRow[];
+  lastAttempt: NutrientLastIngestAttempt | null;
 }