feat(doctor-report): wire the doctorReport module toggle to the health-record surface

The doctorReport module toggle was inert: turning it off hid nothing and the
server-side export route accepted requests regardless. Gate the live surface
on the module — the Health-record settings entry now hides client-side when
the module is off, and POST /api/export/health-record refuses with a 403
module.disabled envelope, so the doctor-report surface cannot be reached over a
Bearer token either.

src/components/settings/__tests__/settings-shell.test.tsx

@@ -235,6 +235,19 @@ describe("<SettingsShell>", () => {
     expect(disabled).not.toContain('href="/settings/coach"');
   });
 
+  it("module-gates the Health-record entry off `user.modules.doctorReport` (B3)", () => {
+    // Fail-open default: doctorReport undefined → entry shown.
+    expect(renderShell({ active: "account" })).toContain(
+      'href="/settings/gesundheitsakte"',
+    );
+    // Explicitly disabled → entry hidden.
+    const disabled = renderShell({
+      active: "account",
+      modules: { doctorReport: false },
+    });
+    expect(disabled).not.toContain('href="/settings/gesundheitsakte"');
+  });
+
   it("falls back to `account` when the pathname doesn't match a known slug", () => {
     const html = renderShell({ pathname: "/settings/totally-bogus" });
     const activeLinkRegex =

src/components/settings/gesundheitsakte-section.tsx

@@ -10,7 +10,11 @@
  * the generic CSV / JSON data-out paths. Export & Import now keeps only
  * the generic data export/import surfaces.
  *
- * Not module-gated: the health record is always available.
+ * Module-gated on `doctorReport` (v1.18.0 B3): the nav entry hides when the
+ * module is off (see `SETTINGS_SECTIONS` in `settings-shell.tsx`), and the
+ * server-side `/api/export/health-record` route refuses with a 403
+ * `module.disabled` envelope — so a disabled doctor-report surface cannot be
+ * reached over a Bearer token either.
  */
 
 import { HealthRecordExportPanel } from "@/components/settings/health-record-export-panel";

src/components/settings/settings-shell.tsx

@@ -157,11 +157,15 @@ export const SETTINGS_SECTIONS: readonly SettingsSection[] = [
   },
   { slug: "api", titleKey: "settings.sections.api.title", icon: KeyRound },
   // v1.18.0 (S5) — the full health record (PDF + FHIR R4 + zip package)
-  // earns its own home, lifted out of Export & Import. Always available.
+  // earns its own home, lifted out of Export & Import. Gated on the
+  // `doctorReport` module: when the user turns the doctor-report surface off,
+  // the entry hides (the server-side `/api/export/health-record` gate is the
+  // hard enforcement; this hides the entry-point to match).
   {
     slug: "gesundheitsakte",
     titleKey: "settings.sections.gesundheitsakte.title",
     icon: FileHeart,
+    moduleGate: "doctorReport",
   },
   {
     slug: "export",