chore(release): v1.28.13 — sharing a document shares only the document

A link created from a document is now document-only: the create route forces an
empty report scope and the served view never aggregates a report, so the
recipient sees the attached document and no health data. Sharing from Settings
keeps the full record form. Earlier document links carry the full record and
should be revoked and re-created.

docs/api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.28.12
+  version: 1.28.13
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.