refactor(medications): move the today list, the compliance buckets and the status update out of their route

GET and POST /api/medications/intake keep authentication, the query and body parsing with their refusals, the 404 and the HTTP mapping. The today list moves to lib/medications/intake-today.ts and the cached compliance buckets to intake-compliance.ts. The status update, one 432-line callback, moves to lib/medications/update-intake-status/ in the order it always ran: the event lookup, the record-only rule, the delegated refusals and the injection site (admission.ts), the take in place or onto another slot (take.ts), then the skip or snooze, the audit row, the rollups and the tails (update-intake-status.ts). The route falls from 634 to 149 lines; no function in the new modules is over 70.

The parity walk recorded before the move (medication-intake-status.parity) is unchanged. The sharing and activity-verb guards read the status-update modules beside the route, and the dense-read guard keeps the moved code in scope.

src/__tests__/dense-measurement-read-guard.test.ts

@@ -74,6 +74,9 @@ const SCOPED_DIRS = [
   "lib/medications/delete-medication.ts",
   "lib/medications/record-intake/",
   "lib/medications/list-intake-events.ts",
+  "lib/medications/intake-today.ts",
+  "lib/medications/intake-compliance.ts",
+  "lib/medications/update-intake-status/",
 ];
 
 /** Types a device writes at sampling rate rather than a few times a day. */

src/__tests__/sharing-surface-guard.test.ts

@@ -442,6 +442,10 @@ const HANDLER_BODY_MODULES: Record<string, readonly string[]> = {
   "app/api/medications/[id]/intake/route.ts": [
     "lib/medications/record-intake/record-intake.ts",
   ],
+  "app/api/medications/intake/route.ts": [
+    "lib/medications/update-intake-status/admission.ts",
+    "lib/medications/update-intake-status/update-intake-status.ts",
+  ],
   "app/api/medications/[id]/intake/[eventId]/route.ts": [
     "lib/medications/update-intake-event.ts",
     "lib/medications/delete-intake-event.ts",