feat(doctor-report): wire the doctorReport module toggle to the health-record surface

The doctorReport module toggle was inert: turning it off hid nothing and the
server-side export route accepted requests regardless. Gate the live surface
on the module — the Health-record settings entry now hides client-side when
the module is off, and POST /api/export/health-record refuses with a 403
module.disabled envelope, so the doctor-report surface cannot be reached over a
Bearer token either.

src/components/settings/__tests__/settings-shell.test.tsx

@@ -235,6 +235,19 @@ describe("<SettingsShell>", () => {
     expect(disabled).not.toContain('href="/settings/coach"');
   });
 
+  it("module-gates the Health-record entry off `user.modules.doctorReport` (B3)", () => {
+    // Fail-open default: doctorReport undefined → entry shown.
+    expect(renderShell({ active: "account" })).toContain(
+      'href="/settings/gesundheitsakte"',
+    );
+    // Explicitly disabled → entry hidden.
+    const disabled = renderShell({
+      active: "account",
+      modules: { doctorReport: false },
+    });
+    expect(disabled).not.toContain('href="/settings/gesundheitsakte"');
+  });
+
   it("falls back to `account` when the pathname doesn't match a known slug", () => {
     const html = renderShell({ pathname: "/settings/totally-bogus" });
     const activeLinkRegex =