chore(release): v1.4.25

Largest feature delta in the v1.4.x line. Insights expands into seven dedicated metric sub-pages; GLP-1 medication tracking lands end-to-end (drug-level chart with Research Mode acknowledgment, EMA titration ladder, cadence + compliance, side-effect taxonomy, pen/vial inventory); cross-source priority becomes a two-axis resolver; per-user timezone threads through ten analytics surfaces; Withings activity + sleep v2 sync; onboarding rebuilt as a nested-route wizard; Personal Records ship end-to-end; Health Score provenance accordion; Coach runs native first-party prompts across six locales with a 1800-assertion refusal-probe matrix; OpenAPI drift gate hard-fails; multi-arch GHCR image. Migrations 0043 through 0060 are additive and forward-only. PROMPT_VERSION 4.24.0 → 4.25.0 with GROUND RULE 9 (refuses dose recommendations) and GROUND RULE 15 (refuses drug-level estimates with MDR + MDCG 2021-24 cites).

See CHANGELOG.md for the full per-section delta.

scripts/check-openapi.ts

@@ -3,9 +3,9 @@
  * Compare the freshly-generated OpenAPI spec against the committed
  * `docs/api/openapi.yaml`. Exits non-zero on drift.
  *
- * Used by the CI gate in `.github/workflows/security.yml`. v1.4.23 runs
- * the step with `continue-on-error: true` while the registry catches
- * up with the hand-maintained spec; v1.4.24+ flips it to hard-fail.
+ * Used by the CI gate in `.github/workflows/security.yml`. Hard-fails on
+ * drift since v1.4.25 — the Zod registry is the source of truth for the
+ * public API contract that the v1.5 iOS Swift codegen consumes.
  */
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";