Take the writes off three read routes

A GET must not have side effects — api-handler.ts says so next to
READ_HTTP_METHODS, where an MCP-audience token is admitted on the safe
methods precisely because they are assumed to write nothing. Three routes
broke that: the sync handshake bumped User.lastSyncedAt, the achievements
read inserted unlock rows, and the cycle calendar fired a discarded promise
at the forecast cache so a failed write left no trace anywhere.

Each write moves to the place that causes it.

The sync checkpoint is now stamped by the batch ingest endpoints for
measurements, mood and intakes. The handshake reports it. That also fixes
the watermark: the checkpoint used to advance past a window the client had
not drained, and a client trusting it would skip that window. It can only
trail a real sync now.

The unlock rows move to a nightly achievement-unlock-sweep. The badge grid
never needed them — unlocked comes from the live metrics and the completion
date is derived — so the payload is unchanged; the rows pin that date and
carry it into the backup, and the sweep reaches accounts that never open
the page.

The cycle forecast moves to a nightly cycle-prediction-refresh. The
CyclePrediction row is not a cache of a read: it is the index the reminder
cron scans, so which reminders an account received depended on whether
somebody had opened the calendar. persistPredictionCache no longer
swallows its errors either — the job reports them.

docs/api/openapi.yaml

@@ -2369,9 +2369,9 @@ paths:
       tags:
         - Sync
       summary: Sync handshake + window metadata
-      description: Cheap 'should I sync?' summary. Returns the previous `lastSyncedAt` checkpoint and advances it server-side
-        on each call. The `sync` block carries the incremental-delta window + tombstone retention so the client reads
-        them rather than hardcoding.
+      description: Cheap 'should I sync?' summary. Returns the `lastSyncedAt` checkpoint, which the batch ingest endpoints
+        advance when a client push lands; this route is a read and writes nothing. The `sync` block carries the
+        incremental-delta window + tombstone retention so the client reads them rather than hardcoding.
       responses:
         "200":
           description: Sync state summary.
@@ -18160,8 +18160,9 @@ components:
         - intakes
         - sync
       additionalProperties: false
-      description: iOS SyncMode handshake. Each GET also advances the server-side `lastSyncedAt` checkpoint and returns the
-        previous value. The cheap 'should I sync?' summary; the durable delta cursor lives on `/api/sync/changes`.
+      description: iOS SyncMode handshake. Reports the server-side `lastSyncedAt` checkpoint, which the batch ingest endpoints
+        set when a client push lands; the handshake itself writes nothing. The cheap 'should I sync?' summary; the
+        durable delta cursor lives on `/api/sync/changes`.
     SyncChangesEnvelope:
       type: object
       properties: