Answer the native client's open server asks

- Publish timezone, glucoseUnit and a features block on the account
  payload; glucoseUnit reads as the closed pair the contract names, and
  features.trackIntake tells a separately released client that
  medications take the record-only switch.
- Refuse a new dose for a record-only medication with
  medication.intake.notTracked on every dose-writing route; the bulk
  route reports it per entry as intake_not_tracked, and correcting an
  already resolved event stays open.
- Answer passkey sign-in failures by name instead of a 500:
  passkey.challenge.expired, passkey.unknown, passkey.response.invalid
  and passkey.verification.failed, each with an audit row.
- Carry one account-wide adherence figure in meta.aggregate on the
  batched compliance read, weighted by expected doses, and accept
  ?days=30|60|90|180|365 for a report window.
- Accept ?days=30|90|180|365 on the mood insights read so stability
  covers the period shown, and name the window it covers.
- Keep only the reminder that announces a dose off APNs when the phone
  owns medication reminders; follow-ups for a dose still open are
  pushed again, marked by a followUp flag the reminder cron sets.
- Document which batch validation issues belong to an entry and pin it
  with a test that splits and resends a batch; publish rejectedFields
  items as ValidationIssue.

src/__tests__/account-payload-consumer-guard.test.ts

@@ -153,6 +153,12 @@ const ACTIVE_RECORD_ONLY_FIELDS = [
  * only when the claim is true and checkable.
  */
 const NO_CLIENT_CONSUMER: Record<string, string> = {
+  features:
+    "A capability probe for clients released apart from the server: the native app asks " +
+    "whether this server takes the record-only medication switch before the account has a " +
+    "medication to learn it from (iOS #116, item 18). The web client is built into the same " +
+    "image as the server, so everything it renders is by construction supported; a web read " +
+    "of the flag would be a read written to satisfy this guard.",
   insurerIkNumber:
     "No web surface reads or writes it — the account form offers the insurer name and the " +
     "insurance number, not the institution number. The native client does consume it: it " +