feat(insights): follow every score over time with one range selector

The health score had no history anywhere, readiness and the sleep score
showed a fixed sparkline, and only the stored nightly scores offered the
range tabs. Every score page now charts its course with the same
7 / 30 / 90 / All tabs, remembered per page, and each point opens its day.

- GET /api/insights/score-history?score=&days= serves the daily course of
  the health score (its stored day rows), readiness (the nightly blend,
  filed on its wake day) and the sleep score (each night against the
  trailing window ending on it), so a point equals what the day view shows
  for that day. MANAGE record read, module-gated for readiness and sleep,
  days 1 to 3650, additive.
- The health score's line breaks where its recipe changed (configuration
  or algorithm version); the usual range is formed from the newest side
  of the last seam.
- The range tabs move into one shared component used by every chart;
  recovery, stress and strain keep their measurement chart, now with the
  range remembered and no overlay dropdown.
- New page /insights/health-score, linked from the score panel and from
  the day view's score tile.

src/__tests__/sharing-surface-guard.test.ts

@@ -1414,6 +1414,10 @@ const DELEGABLE_ROUTES: Record<string, DelegableEntry> = {
     domain: "record",
     why: "Rhythm events over the record's own recordings. Reached only through this module's MANAGE arm; the argument for admitting it is the manage literal's reason line, and the entry here is what leg (a) freezes and leg (f) checks the section against.",
   },
+  "app/api/insights/score-history/route.ts": {
+    domain: "record",
+    why: "A score's daily course: the stored health-score days, the nightly readiness rows, the per-night sleep score. Reached only through this module's MANAGE arm; the argument for admitting it is the manage literal's reason line, and the entry here is what leg (a) freezes and leg (f) checks the section against.",
+  },
   "app/api/insights/targets/route.ts": {
     domain: "record",
     why: "The record's resolved targets. Reached only through this module's MANAGE arm; the argument for admitting it is the manage literal's reason line, and the entry here is what leg (a) freezes and leg (f) checks the section against.",
@@ -1932,6 +1936,11 @@ const DELEGABLE_MANAGE_ROUTES: Record<string, ManageEntry> = {
     conditions: [],
     why: "Rhythm events over the record's own recordings.",
   },
+  "app/api/insights/score-history/route.ts": {
+    domain: "record",
+    conditions: [],
+    why: "A score's daily course, read from the same rows the score pages and the day view read. Deterministic, no provider, nothing enqueued.",
+  },
   "app/api/insights/targets/route.ts": {
     domain: "record",
     conditions: [],
@@ -2080,8 +2089,12 @@ const ACTOR_ROUTES: Record<string, string> = {
  * release (no share level was worded for them), so both modules take a bare
  * `requireAuth()` and drop off the record list and the manage literal.
  * 256 -> 252.
+ *
+ * v1.42 — the score-history read joins the record list and the manage
+ * literal (a score's daily course, MANAGE like the derived score itself).
+ * 252 -> 254.
  */
-const FROZEN_ENTRY_COUNT = 252;
+const FROZEN_ENTRY_COUNT = 254;
 
 /**
  * The two surfaces that authenticate a Bearer token outside `requireAuth` —