fix(backup): carry the aggregation provenance through backup and restore

The disaster-recovery backup selected every Measurement scalar except the
aggregation fields, so a restore brought every `stats:` aggregate back with no
provenance and the Apple Health authority ladder came back flat: an export.xml
source-day estimate could then overwrite a native HealthKit statistic.

`aggregationProvenance` now rides the select, the disaster-recovery
serialization, the payload schema and the restore mapping, following
`externalSourceVersion` exactly — including staying out of the reduced
portable shape, which carries the human-readable subset only. The schema field
is optional, so every backup written before this parses unchanged.

Restoring one of those older backups no longer recreates the ambiguity
migration 0263 repaired: an Apple Health row under a `stats:` identity with no
provenance comes back as LEGACY_UNKNOWN, the sentinel the cumulative drain
already writes in that situation, so a native sync or archive reprocess can
repair it. The gate is scoped as 0263 scoped its backfill — other providers
mint `stats:` identities for their cumulative dailies and have never carried
provenance, and ordinary point rows keep NULL.

src/lib/validations/backup.ts

@@ -43,6 +43,7 @@ import {
   InjectionSite,
   IntakeAttributionSource,
   IntakeSource,
+  MeasurementAggregationProvenance,
   MeasurementSource,
   MeasurementType,
   MedicationCategory,
@@ -86,6 +87,12 @@ const measurementSchema = z
     notesEncrypted: base64BytesSchema.nullable().optional(),
     externalId: z.string().nullable().optional(),
     externalSourceVersion: z.string().nullable().optional(),
+    // Authority of a `stats:` aggregate. `.optional()` keeps every backup
+    // written before this field rode the payload parseable.
+    aggregationProvenance: z
+      .enum(MeasurementAggregationProvenance)
+      .nullable()
+      .optional(),
     glucoseContext: z.enum(GlucoseContext).nullable().optional(),
     sleepStage: z.enum(SleepStage).nullable().optional(),
     rhythmClassification: z.enum(RhythmClassification).nullable().optional(),