feat(lint): refuse UTC day keys outside the time zone module

`instant.toISOString().slice(0, 10)` and parsing a key back as UTC
midnight are the idioms behind every day-boundary fix this year: the
evening west of UTC and the small hours east of it land on the
neighbouring day. A new rule, healthlog/no-utc-day-key, refuses them in
src/ outside src/lib/tz and tests, and refuses a disable directive for
itself that is not next-line or gives no reason.

The time zone module now names every legitimate form: userDayKey for a
person's day, dateOnlyKey / dateOnlyAtNoonUtc / dayKeyAsUtcMidnight for
date-only values and day labels, daysBetweenDateKeys / weekdayOfDateKey /
isCalendarDateKey / statedDateKey for key arithmetic and parsing.

Of the 133 sites the rule found, 84 are gone. Most moved onto a named
helper with no change in behaviour; these changed behaviour:

- cycle calendar, insights, Coach snapshot and prediction refresh start
  their lookbacks at the first instant of the user's day
- a model-transcribed date like "June 10, 2026" no longer lands a day
  early in a process east of UTC (documents and lab scans)
- a custom report range covers exactly the picked days in the profile
  zone instead of starting the evening before west of UTC
- date-of-birth pickers cap at the user's today, not the UTC one
- an allergy onset date is stored at noon UTC like other date-only values
- the report's cycle summary, the Coach's usual BP range and the intake
  projector's rollup recompute use the user's day
- vaccination dates render as dates instead of the previous evening

49 remain, each with its reason on the line above: 39 UTC by design (15
file name stamps, rollup and object keys, the UTC-day score engines) and
10 marked baseline. A guard test requires a classified reason on every
directive and holds the baseline to a ceiling that only goes down.

src/components/settings/report-selection/report-visit-offer.tsx

@@ -25,6 +25,7 @@ import { Button } from "@/components/ui/button";
 import { useEncounters } from "@/hooks/use-encounters";
 import { useFormatters, useTranslations } from "@/lib/i18n/context";
 import type { EncounterKind } from "@/generated/prisma/client";
+import { detectBrowserTimezone, userDayKey } from "@/lib/tz/format";
 
 /**
  * How far ahead a booked visit is treated as the reason for this report.
@@ -36,9 +37,7 @@ export const REPORT_VISIT_HORIZON_DAYS = 14;
 
 /** The local `yyyy-MM-dd` a `DateField` takes, in the reader's own day. */
 function localDay(iso: string): string {
-  const at = new Date(iso);
-  const offset = at.getTimezoneOffset();
-  return new Date(at.getTime() - offset * 60_000).toISOString().slice(0, 10);
+  return userDayKey(new Date(iso), detectBrowserTimezone());
 }
 
 export function ReportVisitOffer({

src/components/settings/report-selection/selection-panel.tsx

@@ -66,6 +66,13 @@ import { orderLeaves } from "@/lib/report-selection/selection";
 
 import { ReportScopePicker } from "./report-scope-picker";
 import { ScopeSummary } from "./scope-summary";
+import { startOfLocalDayKey } from "@/lib/tz/local-day";
+import {
+  DEFAULT_TIMEZONE,
+  detectBrowserTimezone,
+  shiftDateKey,
+  validTimezoneOr,
+} from "@/lib/tz/format";
 
 type ExportFormat = "pdf" | "fhir" | "package";
 
@@ -78,6 +85,12 @@ class ReportRequestError extends Error {}
 export function HealthRecordExportPanel() {
   const { t, locale } = useTranslations();
   const { user } = useAuth();
+  // The report reads its window in the profile zone (the server's
+  // `reportTz`), so the picked days are cut there too.
+  const reportTz = validTimezoneOr(
+    user?.timezone ?? detectBrowserTimezone(),
+    DEFAULT_TIMEZONE,
+  );
   const queryClient = useQueryClient();
 
   const [format, setFormat] = useState<ExportFormat>(
@@ -155,8 +168,15 @@ export function HealthRecordExportPanel() {
     const range =
       customRange && startDate && endDate
         ? {
-            startDate: new Date(`${startDate}T00:00:00Z`).toISOString(),
-            endDate: new Date(`${endDate}T23:59:59Z`).toISOString(),
+            // The picked days are the user's days: from the first instant
+            // of the first to the last instant of the last, in their zone.
+            // UTC midnight started the window the previous evening west of
+            // UTC, and the report read it as one day more.
+            startDate: startOfLocalDayKey(startDate, reportTz).toISOString(),
+            endDate: new Date(
+              startOfLocalDayKey(shiftDateKey(endDate, 1), reportTz).getTime() -
+                1,
+            ).toISOString(),
           }
         : { days };
     const res = await throwIfReproofRequired(
@@ -190,6 +210,7 @@ export function HealthRecordExportPanel() {
     const url = URL.createObjectURL(blob);
     const a = document.createElement("a");
     a.href = url;
+    // eslint-disable-next-line healthlog/no-utc-day-key -- UTC by design: file name stamp, not a day shown or compared
     a.download = `healthlog-health-record-${new Date()
       .toISOString()
       .slice(0, 10)}.${ext}`;