feat(lint): refuse UTC day keys outside the time zone module

`instant.toISOString().slice(0, 10)` and parsing a key back as UTC
midnight are the idioms behind every day-boundary fix this year: the
evening west of UTC and the small hours east of it land on the
neighbouring day. A new rule, healthlog/no-utc-day-key, refuses them in
src/ outside src/lib/tz and tests, and refuses a disable directive for
itself that is not next-line or gives no reason.

The time zone module now names every legitimate form: userDayKey for a
person's day, dateOnlyKey / dateOnlyAtNoonUtc / dayKeyAsUtcMidnight for
date-only values and day labels, daysBetweenDateKeys / weekdayOfDateKey /
isCalendarDateKey / statedDateKey for key arithmetic and parsing.

Of the 133 sites the rule found, 84 are gone. Most moved onto a named
helper with no change in behaviour; these changed behaviour:

- cycle calendar, insights, Coach snapshot and prediction refresh start
  their lookbacks at the first instant of the user's day
- a model-transcribed date like "June 10, 2026" no longer lands a day
  early in a process east of UTC (documents and lab scans)
- a custom report range covers exactly the picked days in the profile
  zone instead of starting the evening before west of UTC
- date-of-birth pickers cap at the user's today, not the UTC one
- an allergy onset date is stored at noon UTC like other date-only values
- the report's cycle summary, the Coach's usual BP range and the intake
  projector's rollup recompute use the user's day
- vaccination dates render as dates instead of the previous evening

49 remain, each with its reason on the line above: 39 UTC by design (15
file name stamps, rollup and object keys, the UTC-day score engines) and
10 marked baseline. A guard test requires a classified reason on every
directive and holds the baseline to a ceiling that only goes down.

src/__tests__/utc-day-key-allowlist-guard.test.ts

@@ -0,0 +1,80 @@
+/**
+ * The allowlist of `healthlog/no-utc-day-key`.
+ *
+ * The lint rule refuses the UTC-day idioms in application source; a site
+ * where the UTC day is right keeps it with an
+ * `eslint-disable-next-line healthlog/no-utc-day-key -- <reason>` directive.
+ * This guard reads every such directive and holds three lines the rule alone
+ * cannot:
+ *
+ *   - every directive is the next-line form (a same-line or block disable on
+ *     the first line of a file hides the rule's own refusal);
+ *   - every reason says which kind of exception it is: `UTC by design:` (the
+ *     UTC day is the correct answer) or `baseline:` (a known site that should
+ *     move to the user's day and has not yet);
+ *   - the `baseline:` set can only shrink. A new UTC-day site is fixed or
+ *     argued as UTC by design, never parked.
+ *
+ * Mutation, done once by hand: a bare directive on a new line in
+ * `src/lib/insights/score-row.ts` fails the reason check; an eleventh
+ * `baseline:` directive fails the ceiling.
+ */
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { describe, expect, it } from "vitest";
+import { walkSourceFiles } from "./helpers/source-files";
+
+const SRC = join(__dirname, "..");
+const RULE = "healthlog/no-utc-day-key";
+/** Known sites still on the UTC day that should not be. Lower it, never raise it. */
+const BASELINE_CEILING = 10;
+
+interface Directive {
+  file: string;
+  line: number;
+  text: string;
+}
+
+function directives(): Directive[] {
+  const out: Directive[] = [];
+  for (const file of walkSourceFiles(SRC, { floor: 2000 })) {
+    // The rule does not run on tests, so no directive there means anything
+    // (this file names the directive in its own documentation).
+    if (/(^|\/)__tests__\/|\.test\.tsx?$/.test(file)) continue;
+    const lines = readFileSync(join(SRC, file), "utf8").split("\n");
+    lines.forEach((text, i) => {
+      if (/eslint-disable/.test(text) && text.includes(RULE)) {
+        out.push({ file, line: i + 1, text: text.trim() });
+      }
+    });
+  }
+  return out;
+}
+
+describe("no-utc-day-key allowlist", () => {
+  const found = directives();
+
+  it("finds the allowlist it guards", () => {
+    // A walk that finds nothing would agree with every assertion below.
+    expect(found.length).toBeGreaterThanOrEqual(40);
+  });
+
+  it("uses only next-line directives", () => {
+    const offenders = found.filter(
+      (d) => !d.text.includes(`eslint-disable-next-line ${RULE}`),
+    );
+    expect(offenders).toEqual([]);
+  });
+
+  it("gives every directive a classified reason", () => {
+    const offenders = found.filter(
+      (d) => !/ -- (UTC by design|baseline): \S.{8,}/.test(d.text),
+    );
+    expect(offenders).toEqual([]);
+  });
+
+  it("never grows the baseline", () => {
+    const baseline = found.filter((d) => d.text.includes(" -- baseline: "));
+    expect(baseline.length).toBeLessThanOrEqual(BASELINE_CEILING);
+  });
+});