feat(body-sites): record a body site on conditions and add a body-site view

A condition (illness episode) can carry where on the body it sits, in the
person's own words and encrypted at rest, plus an optional side (LEFT,
RIGHT, BOTH). Same enum, codec and reasoning as the procedure's site.

- migration 0354: two nullable columns on illness_episodes, reusing the
  laterality type from 0349
- create and edit accept bodySite and laterality; on PATCH an absent key
  keeps the stored value, so an edit from the shipped iPhone app, which
  never sends either field, leaves them untouched
- GET /api/body-sites: the sites the record holds across visits and
  conditions, folded after the decrypt and bounded per kind; with site
  (and laterality) the visits and conditions there, one hop to their
  documents, lab results and visits. Read in the profile section;
  conditions only under an illness grant with the module on, and links
  into ungranted sections come back as unlabelled placeholders
- the link service reads document and visit links from the condition's
  end of the two existing tables
- /checkups gains a Body sites tab; the visit and condition forms share
  one body-site field pair that suggests sites already used; a
  condition's page links its site into the view
- the doctor report, the clinician page and the MCP doctor-visit summary
  name the site on conditions; the Coach illness block carries it
  sanitised, and MCP get_illness_recovery returns it fenced
- backup and restore carry both fields in both file kinds; the site is
  registered as ciphertext and rotates with the key
- i18n in all seven locales, OpenAPI regenerated

Refs #1025

prisma/migrations/0354_condition_body_site/migration.sql

@@ -0,0 +1,17 @@
+-- Body site and side on conditions.
+--
+-- A condition (illness episode) can now carry the body site it sits on, in the
+-- person's own words and encrypted at rest, plus an optional side. It reuses
+-- the `laterality` type migration 0349 created for procedures, so "left knee"
+-- on a condition and "left knee" on a procedure are the same pair of values.
+-- The reasoning for free text and for searching after the decrypt is written
+-- at `Encounter.bodySiteEncrypted` and `IllnessEpisode.bodySiteEncrypted`.
+--
+-- Purely additive: two nullable columns, no backfill, no row rewritten. An
+-- existing condition keeps no site until the person adds one.
+--
+-- Reversibility: both columns can be dropped. The `laterality` type stays,
+-- since `encounters.laterality` still uses it.
+ALTER TABLE "illness_episodes"
+  ADD COLUMN "body_site_encrypted" BYTEA,
+  ADD COLUMN "laterality" "laterality";

prisma/schema.prisma

@@ -7478,6 +7478,24 @@ model IllnessEpisode {
   /// `src/lib/crypto.ts` (Bytes column, `*Encrypted` suffix per
   /// convention).
   noteEncrypted     Bytes?           @map("note_encrypted")
+  /// Where on the body the condition sits, in the person's own words
+  /// ("knee", "lower back", "L4/L5"), v1.39.2. The same field, codec and
+  /// reasoning as `Encounter.bodySiteEncrypted`: free text because no picker
+  /// covers every site and a coded vocabulary the person cannot read is worse
+  /// than their own word, encrypted because it is health data, and searched
+  /// by decrypting the account's own rows server-side
+  /// (`src/lib/body-sites/`), never through a plaintext or hashed copy.
+  ///
+  /// Allowed on every type. An injury or a chronic joint condition is the
+  /// usual case, but a type edit must not lose what was typed.
+  ///
+  /// The shipped iOS app neither sends nor decodes it, and the PATCH treats
+  /// an absent key as "leave alone", so an edit from the phone keeps it.
+  bodySiteEncrypted Bytes?           @map("body_site_encrypted")
+  /// Which side, when the site has one. Same enum and the same NULL meaning
+  /// as `Encounter.laterality`: not stated or not applicable. Plaintext,
+  /// because a side alone says nothing.
+  laterality        Laterality?
   createdAt         DateTime         @default(now()) @map("created_at")
   updatedAt         DateTime         @updatedAt @map("updated_at")
   /// Soft-delete tombstone. NULL = live; non-NULL = deleted at the instant.
@@ -8350,8 +8368,8 @@ enum EncounterKind {
   @@map("encounter_kind")
 }
 
-/// The side of the body a procedure's site is on. See
-/// `Encounter.laterality`.
+/// The side of the body a site is on. See `Encounter.laterality`; since
+/// v1.39.2 also `IllnessEpisode.laterality`.
 enum Laterality {
   LEFT
   RIGHT