merge(reconcile): r3-ios audit findings

src/lib/openapi/routes/measurements.ts

@@ -14,7 +14,7 @@ import {
   measurementSourceEnum,
 } from "@/lib/validations/measurement";
 import { deviceTypeEnum } from "@/lib/validations/source-priority";
-import { dataEnvelope, stdResponses } from "./shared";
+import { dataEnvelope, moduleDisabledResponse, stdResponses } from "./shared";
 
 const batchEntrySchema = z
   .object({
@@ -600,6 +600,7 @@ export const measurementPaths: NonNullable<ZodOpenApiObject["paths"]> = {
             },
           },
         },
+        ...moduleDisabledResponse,
         ...stdResponses,
       },
     },
@@ -619,6 +620,7 @@ export const measurementPaths: NonNullable<ZodOpenApiObject["paths"]> = {
             },
           },
         },
+        ...moduleDisabledResponse,
         ...stdResponses,
       },
     },

src/lib/openapi/routes/profile.ts

@@ -219,11 +219,15 @@ const profileResponse = z
       .string()
       .nullable()
       .describe("German KVNR, decrypted for the form prefill."),
+    // v1.18.0 — resolved module enable/disable map, identical to the
+    // /api/auth/me projection. The native client reads this alias, so it
+    // must carry the same server-authoritative module flags.
+    modules: moduleMapResolved,
   })
   .meta({
     id: "ProfileResponse",
     description:
-      "Flattened profile fields for the native client (GET). The KVNR is decrypted server-side; the IKNR (v1.8.6) is plaintext at rest.",
+      "Flattened profile fields for the native client (GET). The KVNR is decrypted server-side; the IKNR (v1.8.6) is plaintext at rest. The `modules` map mirrors the /api/auth/me projection so the alias carries the same module flags.",
   });
 
 // The PATCH echo mirrors GET but reports KVNR presence as a boolean

src/lib/openapi/routes/shared.ts

@@ -124,3 +124,19 @@ export const consentRequiredResponse = {
     content: { "application/json": { schema: errorEnvelope } },
   },
 };
+
+// ── Module-disabled gate (v1.18.0) ───────────────────────────────────
+// Every module-scoped route runs `requireModuleEnabled(userId, key)`,
+// which returns a 403 when the account has the module turned off — even
+// with a valid Bearer token. The envelope carries
+// `meta.errorCode = "module.disabled"` and `meta.module` (the disabled
+// module key) so the iOS retry classifier branches on it and the client
+// can drop the whole surface. The errorEnvelope shape already declares
+// `meta.errorCode`; `meta.module` is documented here in prose.
+export const moduleDisabledResponse = {
+  "403": {
+    description:
+      'Module disabled for this account: the user (or operator) has the module turned off. `meta.errorCode` = `module.disabled` and `meta.module` carries the disabled module key (e.g. "sleep"). Returned even for a valid Bearer token. Clients hide the whole module surface end-to-end rather than retry.',
+    content: { "application/json": { schema: errorEnvelope } },
+  },
+};