feat(vaccinations): publish the routes, classify them, gate the module

- four route files: list and create, read and edit and delete, restore,
  and the link pair; every delegable one is classified as health
  background, in each leg of the sharing guard, with its reason written
- link and unlink stay bare, consistent with the document and visit link
  routes; the three are revisited as one decision
- vaccinations becomes the nineteenth module key, default-on and
  surface-gated like medications: the data routes stay exempt so a
  restore keeps working and re-enabling finds every dose intact
- a delegate's dose entries get their own sentence in the owner's
  activity view rather than reading as a generic change

tests/integration/doctor-report-dense-data.test.ts

@@ -31,6 +31,7 @@ const MODULES = {
   inboundDocuments: true,
   mentalHealth: true,
   nutrients: true,
+  vaccinations: true,
 } as const;
 
 /** The dense path is about pulse and glucose; nothing else is in scope here. */

tests/integration/doctor-report-sections.test.ts

@@ -335,6 +335,7 @@ describe("doctor-report — module enable/disable gating", () => {
     inboundDocuments: true,
     mentalHealth: true,
     nutrients: true,
+    vaccinations: true,
   } as const;
 
   it("includes every module's data when all modules are enabled", async () => {