feat(ops): synthetic post-deploy journey

Post-publish verify proves the published image boots. Nothing proved that
on a running instance a person can sign in, write a reading and read it
back — which is exactly the shape of the defects this line keeps
rediscovering: a value written and never read.

`scripts/synthetic-journey.mjs` walks that journey in plain Node 22 with no
dependencies, so it runs from a workstation, a runner or the deploy host.
It warms `/`, `/api/health`, `/api/version` and the measurements list first
and discards those timings (the first hit on each route after a deploy is a
cold start), then asserts five legs in order: the served version equals the
expected one, the password flow signs in through a cookie jar, a weight
reading is written with an Idempotency-Key, the same row reads back with
its value, unit and source, and the reversible delete leaves the account
clean. One line per leg with the elapsed time; the first failure ends the
run non-zero with the status and a body excerpt that has every token shape
redacted out of it.

The workflow is `workflow_dispatch` only, with `base_url` and
`expected_version` as inputs and the credentials read from repository
secrets. It is deliberately not wired into the deploy path: the target
instance and the secrets are the maintainer's call.

Mutation proof, against a production build served from
`.next/standalone/server.js` on a throwaway Postgres.

Green:

    warm      35 ms  (discarded)
    ok        version         2 ms  serves 1.38.13
    ok        sign in        78 ms  session cookie held
    ok        write          64 ms  wrote cmtup9lwu0007zhovn0mxajdz
    ok        read back       8 ms  77.7 kg (MANUAL)
    ok        delete         27 ms  account left clean

    synthetic journey green

Read leg broken deliberately — the same server behind a throwaway forwarder
that empties the `GET /api/measurements` list and changes nothing else:

    ok        version         4 ms  serves 1.38.13
    ok        sign in        38 ms  session cookie held
    ok        write          40 ms  wrote cmtupa4ck000gzhovwnij64fz
    FAILED    read back       8 ms  read back: the list came back without the reading
              status 200
              body   {"data":{"measurements":[],"meta":{"total":0}},"error":null}

    synthetic journey RED on "read back"

Version leg broken the same way, by asking the instance for the previous
tag:

    FAILED    version         3 ms  version: instance serves "1.38.13", expected "v1.38.12"

    synthetic journey RED on "version"

`--self-test` carries that proof in the repository: it runs the journey
against an in-process instance nine times, once with nothing broken and
once per broken leg, and fails if a broken leg still comes back green. The
workflow runs it before it touches the real instance.

Gates: typecheck, `node --check`, lint (the three known warnings, no
errors), prettier, the workflow and CI-determinism guards.

.github/workflows/synthetic-journey.yml

@@ -0,0 +1,63 @@
+# Synthetic post-deploy journey.
+#
+# `post-publish-verify.yml` proves the published image boots. This one
+# proves that on a running instance a person can sign in, write a reading
+# and read it back, and that the instance serves the version that was just
+# published.
+#
+# Deliberately manual for now: the maintainer picks the target instance and
+# creates the two repository secrets. Nothing calls this from the deploy
+# path yet.
+#
+# Secrets, both required:
+#   SYNTHETIC_USERNAME — the probe account's username or email
+#   SYNTHETIC_PASSWORD — its password
+#
+# The probe account must be password-only (the password flow stops at the
+# MFA ticket, which the script reports as a configuration failure), and the
+# target must not be the demo instance, where every mutation is blocked.
+name: Synthetic journey
+
+on:
+  workflow_dispatch:
+    inputs:
+      base_url:
+        description: Instance to walk, e.g. https://review.healthlog.dev
+        required: true
+        type: string
+      expected_version:
+        description: Version the instance must serve, e.g. v1.38.13
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  journey:
+    name: Sign in, write a reading, read it back
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 22
+
+      # A check that cannot fail is worse than none. The self-test walks the
+      # journey against an in-process instance once per leg with that leg
+      # broken, and fails if any of them still comes back green.
+      - name: Prove the check can go red
+        run: node scripts/synthetic-journey.mjs --self-test
+
+      # Every input and secret rides an env var — never interpolated into
+      # the shell command.
+      - name: Walk the journey
+        env:
+          BASE_URL: ${{ inputs.base_url }}
+          EXPECTED_VERSION: ${{ inputs.expected_version }}
+          SYNTHETIC_USERNAME: ${{ secrets.SYNTHETIC_USERNAME }}
+          SYNTHETIC_PASSWORD: ${{ secrets.SYNTHETIC_PASSWORD }}
+        run: node scripts/synthetic-journey.mjs