fix(reconcile): close W10 QA Mediums and Lows

Bundle of small reconcile fixes from the W10 QA round:

- Switch tap-target padding -12 px -> -13 px closes the 1.6 px vertical short-fall to spec-strict WCAG 2.5.5 (design M1).
- animate-pulse skeleton sites in daily-briefing, trend-annotation and doctor-report dialog now carry motion-reduce:animate-none (design M2).
- Doctor-report unavailable rows render with text-muted-foreground instead of line-through so the visual reads as 'unavailable' rather than 'deleted'; the italic hint line below still carries the semantic (design M4).
- WelcomeCarousel scrollIntoView now reads scrollBehaviorForUser from src/lib/motion so all four advertised call-sites share the helper (simplifier L-1).
- Coach replay-injection audit row renamed audit.coach.replay-injection -> insights.coach.replay_injection to match the <surface>.<verb> convention across the audit ledger (simplifier L-2).
- /api/integrations/withings/resume drops the unused request param (the handler reads neither body nor headers; requireAuth scopes the call) (simplifier M-4).
- verifyRegistration body gets the same Zod boundary narrow W13 L-3 added to verifyAuthentication; SimpleWebAuthn still owns cryptographic validation (senior-dev L-1).

src/lib/auth/passkey.ts

@@ -42,6 +42,31 @@ const authenticationResponseSchema = z
   })
   .loose();
 
+// v1.4.43 W10 senior-dev L-1 — symmetric Zod narrowing in front of
+// `verifyRegistration`. SimpleWebAuthn's `RegistrationResponseJSON`
+// shape: https://w3c.github.io/webauthn/#dictdef-registrationresponsejson
+// `attestationObject` replaces `authenticatorData + signature` from
+// the authentication shape; everything else mirrors the auth schema.
+const registrationResponseSchema = z
+  .object({
+    id: z.string().min(1),
+    rawId: z.string().min(1),
+    response: z
+      .object({
+        clientDataJSON: z.string().min(1),
+        attestationObject: z.string().min(1),
+        transports: z.array(z.string()).optional(),
+        publicKeyAlgorithm: z.number().optional(),
+        publicKey: z.string().optional(),
+        authenticatorData: z.string().optional(),
+      })
+      .loose(),
+    authenticatorAttachment: z.string().optional(),
+    clientExtensionResults: z.unknown().optional(),
+    type: z.literal("public-key"),
+  })
+  .loose();
+
 type Transport =
   | "ble"
   | "cable"
@@ -145,12 +170,18 @@ export async function verifyRegistration(
   }
 
   try {
-    // The caller passes a parsed JSON body without prior shape-validation —
-    // the SimpleWebAuthn verifier owns full schema validation and throws
-    // on any mismatch. We narrow at the boundary so the rest of the file
-    // sees the documented `RegistrationResponseJSON` shape.
+    // v1.4.43 W10 senior-dev L-1 — Zod narrow at the boundary before
+    // delegating to SimpleWebAuthn's full cryptographic validation.
+    // A malformed body now fails fast with a structured Zod error
+    // rather than crashing on a follow-up `.id` deref deeper in the
+    // verifier. Mirrors the v1.4.43 W13 L-3 narrowing on the
+    // authentication side.
+    const parsed = registrationResponseSchema.safeParse(response);
+    if (!parsed.success) {
+      throw new Error("Registration response shape invalid");
+    }
     const verification = await verifyRegistrationResponse({
-      response: response as RegistrationResponseJSON,
+      response: parsed.data as RegistrationResponseJSON,
       expectedChallenge: challenge.challenge,
       expectedOrigin: getExpectedOrigin(),
       expectedRPID: getRpId(),