chore(release): v1.4.38

Robustness sweep, perf hotspots, full localization, coach gate
cascade closure.

- /api/dashboard/summary cold-mount 4.6 s → ~500 ms via DAY-bucket
  sparkline + 60 s response cache.
- Coach API gate inventory test surfaced and closed two orphan
  routes (chat[id] GET+DELETE, chat-message feedback POST).
- Cross-tz fast-path runtime guard falls back to live for users
  more than ±3 h from UTC; proper bucket minting stays v1.5.
- es / fr / it / pl coverage 27 % → 63 % (~3 400 new strings) plus
  three medication-cluster placeholder restorations.
- IANA timezone validation closes the User.timezone self-DoS
  regression the new dashboard SQL would have surfaced.
- Unit suite 4520 → 4524.

See CHANGELOG.md for the full set.

src/components/settings/arztbericht-hero-card.tsx

@@ -163,7 +163,11 @@ export function ArztberichtHeroCard() {
             // `min-h-11` (44 px) is the WCAG 2.5.5 touch-target floor;
             // we override the default `<Button>` height on mobile and
             // fall back to the compact `sm:h-10` on pointer devices.
-            className="h-11 px-5 text-sm font-medium sm:h-10"
+            // v1.4.38 W-D P3-2 — pair the explicit `h-11` with a
+            // `min-h-11` floor (and a `sm:min-h-9` desktop floor) so a
+            // future className override can't accidentally re-lift the
+            // mobile minimum below the touch-target contract.
+            className="h-11 min-h-11 px-5 text-sm font-medium sm:h-10 sm:min-h-9"
             onClick={() => setOpen(true)}
             disabled={busy}
             aria-describedby={valueStatementId}