docs(sharing): the booster needs two sections, and the guide promised it at one level

The write-level row listed "a vaccination dose and the booster reminder it
suggests" three paragraphs under a section table that puts the vaccination
record in Health background. Read together, that tells a self-hoster a
health-background WRITE grant can plan a booster — which the route beside it
now refuses, because the reminder it mints lives under Readings. The row lists
the dose alone, and the exceptions paragraph, which is where a reader looks for
exactly this, carries the two-section case and says the dose logs either way.

With it, the small things the same pass turned up:

The cycle-insights fixture asserted a property it could not show. Its docblock
claims the cycle-native answer survives the fence, and it seeded no symptom at
all, so `symptomPatterns` was empty in every leg and a regression that emptied
it along with the foreign columns would have passed green. One catalogue
symptom on the luteal days, asserted on the owner leg and on the cycle-only
one.

The immunization rows matched on a bare `role="button"`, which passes vacuously
the day the card becomes a real button and fails for the wrong reason if
anything else in the subtree grows one. They carry the same stable marker the
visit card took.

`/api/cycle/calendar` reads the same wrist-temperature channel the crosstab
does and is deliberately not fenced, and it was the only one of the pair with
nothing saying why: no value from it reaches the response.

The encrypted export's new 403 documented the switch refusal and not the
narrow-scope one it answers first, unlike the two settings operations beside
it. Both sheets say at the top that their Save and Delete are gated at the
caller, so a third mount reads the constraint before it violates it. And one
docblock line ran past the wrap.

src/components/__tests__/delegated-write-affordances.test.tsx

@@ -714,11 +714,15 @@ describe("the immunization log's add, edit and delete", () => {
     });
   };
 
+  /** The row carries the edit affordance only while it opens something. */
+  const rowIsTappable = (html: string) =>
+    html.includes('data-slot-open="vaccination-row-open"');
+
   it("offers all three in the caller's own record", () => {
     const html = render(OWN_RECORD, <VaccinationsView />, seedList);
     expect(html).toContain('data-slot="vaccination-add"');
     // The row opens the edit sheet, which is where the delete lives.
-    expect(html).toContain('role="button"');
+    expect(rowIsTappable(html)).toBe(true);
   });
 
   it("offers a read-only delegate none of them", () => {
@@ -730,7 +734,7 @@ describe("the immunization log's add, edit and delete", () => {
       seedList,
     );
     expect(html).not.toContain('data-slot="vaccination-add"');
-    expect(html).not.toContain('role="button"');
+    expect(rowIsTappable(html)).toBe(false);
   });
 
   it("offers a WRITE delegate the add and not the row", () => {
@@ -740,8 +744,8 @@ describe("the immunization log's add, edit and delete", () => {
       seedList,
     );
     expect(html).toContain('data-slot="vaccination-add"');
-    expect(html, "editing and deleting a dose are MANAGE").not.toContain(
-      'role="button"',
+    expect(rowIsTappable(html), "editing and deleting a dose are MANAGE").toBe(
+      false,
     );
   });
 
@@ -752,7 +756,7 @@ describe("the immunization log's add, edit and delete", () => {
       seedList,
     );
     expect(html).toContain('data-slot="vaccination-add"');
-    expect(html).toContain('role="button"');
+    expect(rowIsTappable(html)).toBe(true);
   });
 
   it("offers a MANAGE delegate outside the section neither", () => {
@@ -764,7 +768,7 @@ describe("the immunization log's add, edit and delete", () => {
       seedList,
     );
     expect(html).not.toContain('data-slot="vaccination-add"');
-    expect(html).not.toContain('role="button"');
+    expect(rowIsTappable(html)).toBe(false);
   });
 
   it("offers the empty state's add on the same rule", () => {