feat(illness): add the condition-journal MVP behind a born-gated module

Introduce a retrospective illness/condition journal: episodes with a
lifecycle (acute / chronic-ongoing / recurring / flare) and a daily
symptom timeline forked structurally from the cycle log-day surface. The
journal is a record, not a medical device — no prediction or diagnosis UI.

- Register `illness` as a born-gated (opt-in / default-off) module. The
  gate resolver flips the disabled-allowlist default to off for born-gated
  keys, so the surface stays dark until the account opts in from the
  Modules hub. `isIllnessEnabled` + `requireIllnessEnabled` delegate to the
  module foundation (one source of truth) and re-stamp an illness errorCode.
- Episode CRUD under /api/illness: list / create / get / edit / resolve /
  delete, plus a per-episode-day day-log upsert on (episodeId, date). Every
  route wraps apiHandler, Zod-validates with returnAllZodIssues, narrows
  userId from auth, builds data field-by-field, and gates the module.
  Free-text notes encrypt at rest through the shared Bytes codec.
- Log-day sheet (cycle fork): ~8 Jackson/WURSS symptom chips 0-3 + a
  functional-impact group + fever + an encrypted note, one row per day.
- Episode history page + a born-gated nav entry, neutral palette, status
  via a neutral Badge, retrospective-only copy. i18n across all six locales.
- Cover the new routes in the module-route-gate inventory; unit tests for
  the day-log upsert, the gate enforcement, and the born-gated resolver.

The /api/auth/me module map now projects the `illness` flag (openapi.yaml
regenerated).

src/lib/modules/__tests__/gate.test.ts

@@ -78,6 +78,54 @@ describe("resolveModuleEnabled — disabled allowlist (default-on)", () => {
   });
 });
 
+describe("resolveModuleEnabled — born-gated module (illness, default-off)", () => {
+  it("is OFF when no preference is recorded (opt-in, not default-on)", () => {
+    expect(resolveModuleEnabled("illness", inputs(), true, ALL_AVAILABLE)).toBe(
+      false,
+    );
+  });
+
+  it("is ON only on an explicit true", () => {
+    expect(
+      resolveModuleEnabled(
+        "illness",
+        inputs({ modulePreferences: { illness: true } }),
+        true,
+        ALL_AVAILABLE,
+      ),
+    ).toBe(true);
+  });
+
+  it("stays OFF on an explicit false", () => {
+    expect(
+      resolveModuleEnabled(
+        "illness",
+        inputs({ modulePreferences: { illness: false } }),
+        true,
+        ALL_AVAILABLE,
+      ),
+    ).toBe(false);
+  });
+
+  it("operator-off short-circuits even when the user opted in", () => {
+    expect(
+      resolveModuleEnabled(
+        "illness",
+        inputs({ modulePreferences: { illness: true } }),
+        true,
+        operator({ illness: false }),
+      ),
+    ).toBe(false);
+  });
+
+  it("does not affect sibling default-on modules", () => {
+    const i = inputs({ modulePreferences: {} });
+    expect(resolveModuleEnabled("illness", i, true, ALL_AVAILABLE)).toBe(false);
+    expect(resolveModuleEnabled("mood", i, true, ALL_AVAILABLE)).toBe(true);
+    expect(resolveModuleEnabled("labs", i, true, ALL_AVAILABLE)).toBe(true);
+  });
+});
+
 describe("resolveModuleEnabled — cycle delegation", () => {
   it("ignores the module blob and reads the cycle gate (gender-derived)", () => {
     // Even a crafted `{ cycle: false }` blob cannot override the real