feat(lint): refuse UTC day keys outside the time zone module

`instant.toISOString().slice(0, 10)` and parsing a key back as UTC
midnight are the idioms behind every day-boundary fix this year: the
evening west of UTC and the small hours east of it land on the
neighbouring day. A new rule, healthlog/no-utc-day-key, refuses them in
src/ outside src/lib/tz and tests, and refuses a disable directive for
itself that is not next-line or gives no reason.

The time zone module now names every legitimate form: userDayKey for a
person's day, dateOnlyKey / dateOnlyAtNoonUtc / dayKeyAsUtcMidnight for
date-only values and day labels, daysBetweenDateKeys / weekdayOfDateKey /
isCalendarDateKey / statedDateKey for key arithmetic and parsing.

Of the 133 sites the rule found, 84 are gone. Most moved onto a named
helper with no change in behaviour; these changed behaviour:

- cycle calendar, insights, Coach snapshot and prediction refresh start
  their lookbacks at the first instant of the user's day
- a model-transcribed date like "June 10, 2026" no longer lands a day
  early in a process east of UTC (documents and lab scans)
- a custom report range covers exactly the picked days in the profile
  zone instead of starting the evening before west of UTC
- date-of-birth pickers cap at the user's today, not the UTC one
- an allergy onset date is stored at noon UTC like other date-only values
- the report's cycle summary, the Coach's usual BP range and the intake
  projector's rollup recompute use the user's day
- vaccination dates render as dates instead of the previous evening

49 remain, each with its reason on the line above: 39 UTC by design (15
file name stamps, rollup and object keys, the UTC-day score engines) and
10 marked baseline. A guard test requires a classified reason on every
directive and holds the baseline to a ceiling that only goes down.

src/components/links/vault-document-options.ts

@@ -31,6 +31,7 @@ import {
   DOCUMENT_LIST_MAX_LIMIT,
   type InboundDocumentDto,
 } from "@/lib/validations/inbound-documents";
+import { daysBetweenDateKeys } from "@/lib/tz/format";
 
 /**
  * How many pages the picker walks. At the route's ceiling of 100 that is a
@@ -38,8 +39,6 @@ import {
  */
 const VAULT_PICKER_MAX_PAGES = 10;
 
-const DAY_MS = 24 * 60 * 60 * 1000;
-
 /** The fields the option list reads off a document. */
 export type VaultDocument = Pick<
   InboundDocumentDto,
@@ -82,10 +81,12 @@ export function isNearAnchor(
   anchorIso: string | null,
 ): boolean {
   if (!documentDay || !anchorIso) return false;
-  const day = Date.parse(`${documentDay.slice(0, 10)}T00:00:00.000Z`);
-  const anchor = Date.parse(`${anchorIso.slice(0, 10)}T00:00:00.000Z`);
-  if (Number.isNaN(day) || Number.isNaN(anchor)) return false;
-  return Math.abs(day - anchor) <= ENCOUNTER_SUGGEST_WINDOW_DAYS * DAY_MS;
+  const gap = daysBetweenDateKeys(
+    anchorIso.slice(0, 10),
+    documentDay.slice(0, 10),
+  );
+  if (Number.isNaN(gap)) return false;
+  return Math.abs(gap) <= ENCOUNTER_SUGGEST_WINDOW_DAYS;
 }
 
 /**