feat(achievements): dedicated /achievements page with locked/unlocked list

Pre-v1.4.15 the page silently dropped locked achievements, so the user
only saw what they had already earned. Now every badge renders — locked
ones are grayed out with a "Locked" badge, criterion hint
({current} / {target}), and a progress bar. Unlocked entries keep the
existing primary-gradient card with the "Completed on …" footer.

Achievements are grouped by a new `category` axis (medication, vitals,
security, engagement) — derived in `getAchievementCategory()` so a
metric is always in exactly one bucket. Inside a category, unlocked
items sort first; among locked items the closest-to-unlock one ranks
first so the user always sees their immediate next goal at the top.

The sidebar link to /achievements was already in place under the
user-area group; this commit only adds the new locked/grouped render
plus an e2e smoke spec that walks the desktop sidebar → click →
heading visible path.

i18n: 9 new keys under `achievements.*` (locked, criterionHint,
progressPercent, categories.{medication,vitals,security,engagement},
dashboardCard.{title,viewAll,empty}) — EN + DE. C4's parity audit will
sweep later.

Tests: +9 unit (groupByCategory ordering + page render in EN/DE) +
1 e2e (sidebar → /achievements). 909 / 909 unit pass.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

.env.example

@@ -142,3 +142,14 @@ API_TOKEN_HMAC_KEY="REPLACE-WITH-OUTPUT-OF-openssl-rand-hex-32"
 # BACKUP_S3_REGION="auto"           # "auto" for Cloudflare R2; real region for AWS S3
 # BACKUP_RETENTION_DAYS="30"        # objects older than this are pruned (best-effort; prefer a bucket lifecycle rule)
 # BACKUP_ENCRYPTION_KEY=""          # 64-hex-char or base64 32-byte; SEPARATE from ENCRYPTION_KEY
+
+
+# -----------------------------------------------------------------------------
+# Auto-deploy webhook (v1.4.15 — phase C2)
+# -----------------------------------------------------------------------------
+# Coolify (or any CI) pings POST /api/internal/deploy-webhook after a deploy
+# attempt with success/failure. We verify the request via this shared secret
+# carried in the `X-Deploy-Webhook-Secret` header (timing-safe compare).
+# Generate with `openssl rand -hex 32`. Configure the SAME value in Coolify's
+# Notifications → Webhook custom-headers panel. See docs/audit/v1415-auto-deploy.md.
+# DEPLOY_WEBHOOK_SECRET=""