v1.4.34.5 — audit follow-on: critical-path tests + iOS textarea zoom

Follow-on to v1.4.34.4.

Tests:
  24 new integration tests across 5 files closing the highest
  critical-path gaps the test-coverage audit flagged:
    - auth-password-change.test.ts pins the v1.4.34.3+
      destroyAllSessions three-transport revocation contract.
    - admin-reset-password.test.ts mirrors the same shape for
      admin resets.
    - withings-oauth.test.ts covers connect / callback / disconnect
      + state-token replay rejection.
    - passkey-register.test.ts covers register-options +
      register-verify + tampered-attestation + challenge single-use.
    - cache-invalidation-coverage.test.ts grids the IW-G
      invalidation matrix across 5 write surfaces.
  Integration suite: 197/50 → 222/55. tsc + lint clean.

Mobile:
  Five textareas no longer trigger iOS Safari zoom-on-focus. The
  Coach composer, bug-report description, admin feedback note,
  medication-side-effects notes, and medication-intake JSON
  import all shipped text-sm (14 px). iOS Safari zooms whenever
  an input renders below 16 px. Switched each to
  `text-base sm:text-sm` so mobile clears the floor while desktop
  keeps the compact look.

src/app/bugreport/page.tsx

@@ -207,7 +207,9 @@ export default function BugReportPage() {
               minLength={10}
               maxLength={5000}
               rows={8}
-              className="border-input bg-background text-foreground placeholder:text-muted-foreground focus-visible:ring-ring w-full rounded-md border px-3 py-2 text-sm focus-visible:ring-2 focus-visible:outline-none"
+              // text-base on mobile so iOS Safari doesn't zoom on
+              // focus; text-sm on sm+ keeps the compact desktop look.
+              className="border-input bg-background text-foreground placeholder:text-muted-foreground focus-visible:ring-ring w-full rounded-md border px-3 py-2 text-base focus-visible:ring-2 focus-visible:outline-none sm:text-sm"
             />
           </div>
 

src/app/medications/page.tsx

@@ -466,7 +466,9 @@ function IntakeImportDialog({
             onChange={(e) => setJsonText(e.target.value)}
             placeholder={t("medications.importPaste")}
             rows={8}
-            className="border-input bg-background text-foreground placeholder:text-muted-foreground focus-visible:ring-ring w-full rounded-md border px-3 py-2 font-mono text-sm focus-visible:ring-2 focus-visible:outline-none"
+            // text-base on mobile so iOS Safari doesn't zoom on
+            // focus; text-sm on sm+ for the compact import textarea.
+            className="border-input bg-background text-foreground placeholder:text-muted-foreground focus-visible:ring-ring w-full rounded-md border px-3 py-2 font-mono text-base focus-visible:ring-2 focus-visible:outline-none sm:text-sm"
           />
           {result && (
             <p

src/components/admin/feedback-inbox-section.tsx

@@ -501,7 +501,9 @@ function FeedbackDetailDialog({
               rows={3}
               maxLength={5000}
               placeholder={t("admin.feedback.adminNotePlaceholder")}
-              className="border-input bg-background text-foreground placeholder:text-muted-foreground focus-visible:ring-ring w-full rounded-md border px-3 py-2 text-sm focus-visible:ring-2 focus-visible:outline-none"
+              // text-base on mobile so iOS Safari doesn't zoom on
+              // focus; text-sm on sm+ keeps the compact admin look.
+              className="border-input bg-background text-foreground placeholder:text-muted-foreground focus-visible:ring-ring w-full rounded-md border px-3 py-2 text-base focus-visible:ring-2 focus-visible:outline-none sm:text-sm"
             />
             <div className="flex justify-end">
               <Button

src/components/insights/coach-panel/coach-input.tsx

@@ -208,7 +208,12 @@ export function CoachInput({
           // `max-h-[9.5rem]`, ≈6 lines at the current line-height).
           rows={1}
           className={cn(
-            "w-full resize-none bg-transparent text-sm leading-relaxed outline-none",
+            // `text-base` (16 px) on mobile so iOS Safari does not
+            // zoom-on-focus — the kerned `text-sm` (14 px) trips the
+            // 16 px floor and yanks the viewport on every Coach tap.
+            // Desktop shrinks back to `text-sm` for the compact
+            // composer.
+            "w-full resize-none bg-transparent text-base leading-relaxed outline-none sm:text-sm",
             "max-h-[9.5rem] overflow-auto",
             "placeholder:text-muted-foreground disabled:opacity-60",
           )}

src/components/medications/SideEffectsSection.tsx

@@ -474,7 +474,10 @@ export function SideEffectsSection({ medicationId }: SideEffectsSectionProps) {
                 enterKeyHint="done"
                 autoCapitalize="sentences"
                 autoComplete="off"
-                className="border-input bg-background text-foreground w-full rounded-md border px-2 py-1.5 text-sm"
+                // text-base on mobile so iOS Safari doesn't
+                // zoom-on-focus; text-sm on sm+ keeps the compact
+                // notes-row visual.
+                className="border-input bg-background text-foreground w-full rounded-md border px-2 py-1.5 text-base sm:text-sm"
               />
               <p className="text-muted-foreground text-right text-[10px]">
                 {notes.length} / {NOTES_MAX}