chore(release): v1.37.6 — the server-side safety pass

Two hardening changes collected on the trunk: a screening reminder can no
longer be marked done through a crafted request, and editing a custom mood
tag, tag group or cycle symptom now leaves an audit entry the way deleting
one already did.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.37.5",
+  "version": "1.37.6",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",