feat(body-sites): record a body site on conditions and add a body-site view

A condition (illness episode) can carry where on the body it sits, in the
person's own words and encrypted at rest, plus an optional side (LEFT,
RIGHT, BOTH). Same enum, codec and reasoning as the procedure's site.

- migration 0354: two nullable columns on illness_episodes, reusing the
  laterality type from 0349
- create and edit accept bodySite and laterality; on PATCH an absent key
  keeps the stored value, so an edit from the shipped iPhone app, which
  never sends either field, leaves them untouched
- GET /api/body-sites: the sites the record holds across visits and
  conditions, folded after the decrypt and bounded per kind; with site
  (and laterality) the visits and conditions there, one hop to their
  documents, lab results and visits. Read in the profile section;
  conditions only under an illness grant with the module on, and links
  into ungranted sections come back as unlabelled placeholders
- the link service reads document and visit links from the condition's
  end of the two existing tables
- /checkups gains a Body sites tab; the visit and condition forms share
  one body-site field pair that suggests sites already used; a
  condition's page links its site into the view
- the doctor report, the clinician page and the MCP doctor-visit summary
  name the site on conditions; the Coach illness block carries it
  sanitised, and MCP get_illness_recovery returns it fenced
- backup and restore carry both fields in both file kinds; the site is
  registered as ciphertext and rotates with the key
- i18n in all seven locales, OpenAPI regenerated

Refs #1025

src/lib/validations/backup.ts

@@ -1072,6 +1072,13 @@ const illnessEpisodeBackupSchema = z
     note: z.string().nullable().optional(),
     createdAt: isoDateTime.optional(),
     noteEncrypted: base64BytesSchema.nullable().optional(),
+    // v1.39.2 — the body site and side. Optional so a file written before
+    // they existed still parses; the condition restores with neither. The
+    // site rides as ciphertext in a disaster-recovery file and as plaintext
+    // in a portable one, exactly like the note beside it.
+    bodySite: z.string().max(200).nullable().optional(),
+    bodySiteEncrypted: base64BytesSchema.nullable().optional(),
+    laterality: z.enum(Laterality).nullable().optional(),
     deletedAt: isoDateTime.nullable().optional(),
     updatedAt: isoDateTime.optional(),
     dayLogs: z.array(illnessDayLogBackupSchema).default([]),

src/lib/validations/body-sites.ts

@@ -0,0 +1,26 @@
+/**
+ * The body-site view query (v1.39.2).
+ *
+ * Without `site` the route answers with the sites the record holds, which is
+ * both the view's list of choices and the suggestions a body-site field offers
+ * while the person types. With `site` it also answers with what is filed at
+ * that site. `site` is compared after the decrypt, case and accents folded, to
+ * the whole stored site: it names a site the list offered, it is not a word
+ * search (the procedures tab keeps that).
+ */
+import { z } from "zod/v4";
+
+import { lateralityEnum } from "@/lib/validations/encounters";
+
+export const bodySiteQuerySchema = z
+  .object({
+    site: z.string().trim().min(1).max(200).optional(),
+    laterality: lateralityEnum.optional(),
+  })
+  .strict()
+  .refine((v) => v.laterality === undefined || v.site !== undefined, {
+    path: ["laterality"],
+    message: "laterality narrows a site and needs one",
+  });
+
+export type BodySiteQuery = z.infer<typeof bodySiteQuerySchema>;

src/lib/validations/illness.ts

@@ -15,6 +15,7 @@
  */
 import { z } from "zod/v4";
 import { isPlausibleEntryInstant } from "@/lib/validations/entry-instant";
+import { lateralityEnum } from "@/lib/validations/encounters";
 
 /**
  * Plausible-instant bound shared with the measurement / mood / cycle
@@ -52,6 +53,14 @@ export const illnessLifecycleEnum = z.enum([
 
 /* ── episode CRUD ─────────────────────────────────────────────────── */
 
+/**
+ * Where on the body, in the person's own words (v1.39.2). Becomes
+ * `bodySiteEncrypted`. Bounded like the procedure's site: a label, not prose.
+ * Absent leaves the stored value alone on an edit; `null` or blank clears it.
+ */
+const bodySite = z.string().max(200).nullable().optional();
+const laterality = lateralityEnum.nullable().optional();
+
 /**
  * Create an episode. `label` is the user-facing name; `note` is encrypted
  * at rest. `parentConditionId` threads a FLARE/RECURRING bout under a
@@ -66,6 +75,8 @@ export const illnessEpisodeCreateSchema = z
     resolvedAt: boundedInstant.nullable().optional(),
     parentConditionId: z.string().min(1).max(40).nullable().optional(),
     note: z.string().max(2000).nullable().optional(),
+    bodySite,
+    laterality,
   })
   // An episode can never resolve before it began. `onsetAt` defaults to "now"
   // server-side when omitted, so the invariant only bites when BOTH instants
@@ -95,6 +106,8 @@ export const illnessEpisodeUpdateSchema = z
     resolvedAt: boundedInstant.nullable().optional(),
     parentConditionId: z.string().min(1).max(40).nullable().optional(),
     note: z.string().max(2000).nullable().optional(),
+    bodySite,
+    laterality,
   })
   .strict()
   // When BOTH instants are in the same edit body, enforce the window order at