Merge origin/main (v1.44.2) into fix/v145-sheet-motion

next stays on main's 16.4.2 (the RCE and Server Actions advisories) with its two companions; release's newer dev tools and its own additions are kept. The lockfile is release's, re-resolved. pt-BR, which main does not have, takes the one key main added.

docs/api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.44.0
+  version: 1.44.2
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.
 
@@ -64112,7 +64112,8 @@ components:
                     - diaHigh
                   additionalProperties: false
                 - type: "null"
-              description: Personalised blood-pressure target numbers. Null when the profile has no date of birth.
+              description: "Blood-pressure target numbers: the user's own target (`/api/user/thresholds`) where set, else the
+                age-banded default. Null when there is neither a target nor a date of birth."
             bpSysRange:
               anyOf:
                 - type: object
@@ -64132,7 +64133,8 @@ components:
                     - orangeMax
                   additionalProperties: false
                 - type: "null"
-              description: Systolic traffic-light range. Null when the profile has no date of birth.
+              description: Systolic traffic-light range, the user's own target winning over the age default. Null when there is
+                neither a target nor a date of birth.
             bpDiaRange:
               anyOf:
                 - type: object
@@ -64152,7 +64154,8 @@ components:
                     - orangeMax
                   additionalProperties: false
                 - type: "null"
-              description: Diastolic traffic-light range. Null when the profile has no date of birth.
+              description: Diastolic traffic-light range, the user's own target winning over the age default. Null when there is
+                neither a target nor a date of birth.
             pulseDisplayRange:
               type: object
               properties:
@@ -64170,7 +64173,8 @@ components:
                 - orangeMin
                 - orangeMax
               additionalProperties: false
-              description: Resting-pulse display range. Always present — falls back to the AHA reference range with no date of birth.
+              description: "Resting-pulse display range: the user's own target where set, else the age / sex percentile band (the AHA
+                reference range with no date of birth). Always present."
             pulseBands:
               type: array
               items:
@@ -64191,7 +64195,7 @@ components:
                   - max
                   - color
                 additionalProperties: false
-              description: Resting-pulse chart bands. Always present — AHA fallback with no date of birth.
+              description: Resting-pulse chart bands, drawn from the same range as `pulseDisplayRange`. Always present.
             bodyFatRange:
               type: object
               properties:
@@ -64203,7 +64207,7 @@ components:
                 - min
                 - max
               additionalProperties: false
-              description: Gender-aware body-fat target range. Always present.
+              description: "Body-fat target range: the user's own target where set, else the gender-aware default. Always present."
             bodyFatBands:
               type: array
               items:
@@ -64224,7 +64228,7 @@ components:
                   - max
                   - color
                 additionalProperties: false
-              description: Body-fat chart bands. Always present.
+              description: Body-fat chart bands, drawn from the same range as `bodyFatRange`. Always present.
             weightRange:
               anyOf:
                 - type: object