chore(release): v1.28.56 — documents, closer to hand

Bundles the documents/coach slices onto the daily-system release:
- Ask the Coach about a document opens in a side panel (expandable to full
  page), not a full-page jump.
- Attach one or more documents to a Coach chat from the composer (pick from the
  vault or upload); the conversation runs fenced — grounded in those documents
  only, no health data or tools — and can never reach the tool loop (a sticky
  document-scoped flag plus dual client/server enforcement; migration 0245).
- A read document that looks like lab work has its values detected and proposed
  for your labs, added only on your one-tap confirm.
- A lab scan is also filed in your vault (encrypted) and linked to the readings.

Adversarially security-reviewed (multi-document attach): all clear.

CHANGELOG.md

@@ -2,7 +2,28 @@
 
 ## [Unreleased]
 
-## [1.28.55] — 2026-07-16 — The Today view comes to life
+## [1.28.56] — 2026-07-17 — Documents, closer to hand
+
+Four changes bring documents and your record closer together:
+
+- **Ask the Coach opens beside your document.** Asking about a document now
+  opens the Coach in a side panel rather than jumping to a full page — expand it
+  to full screen whenever you like, and it keeps its place.
+- **Bring documents into a Coach chat.** From the composer's "+", attach one or
+  more documents — pick from your vault or upload a new one, at the start or
+  mid-conversation — and the Coach answers grounded in them. A conversation with
+  a document runs in its fenced mode: grounded in those documents only, with no
+  access to your health data or tools, so nothing in an uploaded file can reach
+  anything it shouldn't.
+- **Lab values from a document, proposed for your labs.** When a document you've
+  had read looks like lab work, its values are detected and proposed — one tap to
+  add them to your labs; they're never added without your say-so.
+- **A lab scan is also kept.** Scanning a lab report into your labs now also
+  files the document in your vault (encrypted, like every upload) and links the
+  two, so the reading and its source stay together.
+
+Migration 0245 (attaching multiple documents to a conversation) accompanies this
+release; existing document chats carry over unchanged.
 
 Three pieces turn the Today view into a daily loop:
 

docs/api/openapi.yaml

@@ -1,7 +1,7 @@
 openapi: 3.1.0
 info:
   title: HealthLog API
-  version: 1.28.55
+  version: 1.28.56
   description: >-
     Self-hosted personal-health-tracking PWA — public API surface for the iOS native client and external ingest.
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "healthlog",
-  "version": "1.28.55",
+  "version": "1.28.56",
   "description": "Self-hosted personal-health-tracking PWA with Withings integration, AI insights, and doctor-report PDF export.",
   "license": "PolyForm-Noncommercial-1.0.0",
   "homepage": "https://healthlog.dev",

public/sw.js

@@ -36,7 +36,7 @@ try {
 // v1.4.38.4 → v1.4.42. Do not hand-edit; bump `package.json` and rebuild.
 const CACHE_VERSION =
   (typeof self !== "undefined" && self.__APP_VERSION__) ||
-  /* @sw-version-fallback */ "v1.28.55";
+  /* @sw-version-fallback */ "v1.28.56";
 const STATIC_CACHE = `healthlog-static-${CACHE_VERSION}`;
 const PAGE_CACHE = `healthlog-pages-${CACHE_VERSION}`;
 // v1.18.6 — read-only data cache for a curated allowlist of safe GET `/api/*`