chore(release): v1.4.38

Robustness sweep, perf hotspots, full localization, coach gate
cascade closure.

- /api/dashboard/summary cold-mount 4.6 s → ~500 ms via DAY-bucket
  sparkline + 60 s response cache.
- Coach API gate inventory test surfaced and closed two orphan
  routes (chat[id] GET+DELETE, chat-message feedback POST).
- Cross-tz fast-path runtime guard falls back to live for users
  more than ±3 h from UTC; proper bucket minting stays v1.5.
- es / fr / it / pl coverage 27 % → 63 % (~3 400 new strings) plus
  three medication-cluster placeholder restorations.
- IANA timezone validation closes the User.timezone self-DoS
  regression the new dashboard SQL would have surfaced.
- Unit suite 4520 → 4524.

See CHANGELOG.md for the full set.

src/app/api/admin/drain-per-sample-cumulative/route.ts

@@ -30,7 +30,10 @@ import {
   safeJson,
 } from "@/lib/api-response";
 import { annotate } from "@/lib/logging/context";
-import { drainPerSampleCumulative } from "@/lib/measurements/drain-per-sample-cumulative";
+import {
+  drainPerSampleCumulative,
+  DRAIN_CUMULATIVE_CUTOFF_HOURS,
+} from "@/lib/measurements/drain-per-sample-cumulative";
 
 interface DrainBody {
   userId?: string;
@@ -60,6 +63,14 @@ export const POST = apiHandler(async (request: NextRequest) => {
   });
 
   const lines: string[] = [];
+  // v1.4.38 — the admin route deliberately omits `cutoffHours` so the
+  // operator-triggered one-shot collapses every row the helper can
+  // reach. `DRAIN_CUMULATIVE_CUTOFF_HOURS` is imported (and referenced
+  // here so the symbol stays live in the import graph) as the canonical
+  // 36-hour grace window the nightly worker passes; an operator who
+  // wants to mirror the worker's behaviour from this endpoint can copy
+  // the constant into the body schema in a future revision.
+  void DRAIN_CUMULATIVE_CUTOFF_HOURS;
   const summary = await drainPerSampleCumulative(prisma, {
     userId,
     dryRun,