feat(labs): accept optional OCR provenance on lab create

The structured lab-create path (POST /api/labs) now accepts an optional
`source` marker ("MANUAL" | "OCR"). The on-device-OCR ingestion path posts
"OCR" so a reading captured from a phone-camera lab photo records its
provenance; the raw image never touches the server on this path. Omitting
the field reads as "MANUAL", so the existing hand-entry contract is
unchanged. The value is narrowed by a closed Zod enum and assigned
field-by-field, never spread from the body. Mirrors the "OCR" source the
server-side /api/labs/ocr/commit path already stamps.

Regenerate the OpenAPI spec for the widened request body.

docs/api/openapi.yaml

@@ -7056,8 +7056,10 @@ paths:
       tags:
         - Labs
       summary: Record a lab result
-      description: Creates a single lab result for the caller. `source` is hardcoded MANUAL on this path. The optional note is
-        AES-256-GCM encrypted before write. Audits as `labResult.create`.
+      description: Creates a single lab result for the caller. The optional `source` marks provenance (`"MANUAL"` | `"OCR"`);
+        it defaults to `"MANUAL"` when omitted, so the legacy hand-entry contract is unchanged. The on-device-OCR client
+        posts `"OCR"` after the human confirms the parsed values — the raw image never touches the server on this path.
+        The optional note is AES-256-GCM encrypted before write. Audits as `labResult.create`.
       requestBody:
         required: true
         content:
@@ -7104,6 +7106,11 @@ paths:
                       maxLength: 2000
                     - type: string
                       const: ""
+                source:
+                  type: string
+                  enum:
+                    - MANUAL
+                    - OCR
               required:
                 - takenAt
       responses: