fix(measurements): scope external-id delete to app-minted HealthKit rows

DELETE /api/measurements/by-external-ids now only tombstones rows the iOS
client minted through its HealthKit ingestion path (source APPLE_HEALTH).
An externalId the app never minted — an integration- or manually-sourced
row that happens to collide on externalUUID — falls outside the predicate
and is a no-op rather than a delete. Defence-in-depth so a foreign
HealthKit sample with a colliding UUID cannot be tombstoned by the
periodic reconciliation. The delete stays user-scoped as before.

Add a route test proving a foreign-origin externalId is not deleted, and
regenerate the OpenAPI spec for the narrowed contract.

docs/api/openapi.yaml

@@ -2363,8 +2363,10 @@ paths:
       tags:
         - Measurements
       summary: Delete measurements by external ID (iOS deletion-sync)
-      description: Removes the user's measurement rows whose externalId is in the request list. Rows owned by another user are
-        silently skipped (cross-user 404 guard). Up to 500 externalIds per call.
+      description: "Removes the user's HealthKit-ingested measurement rows (source `APPLE_HEALTH`) whose externalId is in the
+        request list. Only app-minted rows are eligible: an externalId that maps to an integration- or manually-sourced
+        row (a colliding externalUUID) is a no-op, never a delete. Rows owned by another user are silently skipped
+        (cross-user 404 guard). Up to 500 externalIds per call."
       requestBody:
         required: true
         content: