fix(export): make the standard report a click, not a preselection

The scope picker arrived with the standard doctor's report already ticked,
so someone who opened the panel and pressed Generate sent material they
never chose. Nothing is selected now until a person selects it.

The template keeps its definition and loses its automatic application: it
sits on a button at the top of the picker, named, on both surfaces that
mount the picker, and it stays there so the standard set can be restored
after experimenting. One click still gets a complete doctor's report.

Generate and the share-link create refuse an empty scope, with the scope
line beside them saying what to do rather than reporting a failure after
the press; the line also describes the control, so the disabled state is
not silent for a screen reader.

e2e/settings-export.spec.ts

@@ -101,12 +101,11 @@ test.describe("Settings → Export & Import", () => {
   test("opens the scope picker expanded on a first run, fenced tier and all", async ({
     page,
   }) => {
-    // The three panel states are the release's whole point, and the first one
-    // is the only place a template is applied. It has to be VISIBLE — a
-    // template behind a collapsed disclosure is opt-out wearing a hat — so the
-    // picker, its twelve group rows and the fenced tier all render without a
-    // click. Asserted against the export mount; the share form runs its own
-    // picker with its own defaults.
+    // The three panel states are the release's whole point, and on the first
+    // one nothing is selected at all. The picker still opens without a click,
+    // because with an empty scope the standard-report button and the named
+    // groups are exactly what the person needs in front of them. Asserted
+    // against the export mount; the share form runs its own picker.
     await openGesundheitsakte(page);
     await expect(page.getByTestId("report-scope-picker-export")).toBeVisible({
       timeout: 10_000,
@@ -128,6 +127,61 @@ test.describe("Settings → Export & Import", () => {
     await expect(page.getByTestId("report-scope-summary-export")).toBeVisible();
   });
 
+  test("first run selects nothing and refuses to generate until it does", async ({
+    page,
+  }) => {
+    // The rule the whole surface exists for: nothing reaches the report that
+    // was not ticked. So a first run starts empty, Generate refuses the press
+    // and says why, and the one-click action is what makes that cost nothing —
+    // it fills the standard set and the control comes alive.
+    await openGesundheitsakte(page);
+    const generate = page.getByTestId("health-record-generate");
+    await expect(generate).toBeVisible({ timeout: 10_000 });
+    await expect(generate).toBeDisabled();
+    await expect(
+      page.getByTestId("report-group-row-vitals-export"),
+    ).toContainText("0/7");
+    await expect(page.getByTestId("report-scope-summary-export")).toContainText(
+      "Nothing selected yet",
+    );
+
+    await page.getByTestId("report-apply-standard-export").click();
+
+    await expect(generate).toBeEnabled();
+    // Exactly the shipped set: the three classic vitals, weight and BMI, and
+    // nothing at all from the groups the template leaves alone.
+    await expect(
+      page.getByTestId("report-group-row-vitals-export"),
+    ).toContainText("3/7");
+    await expect(
+      page.getByTestId("report-group-row-body-export"),
+    ).toContainText("2/12");
+    await expect(
+      page.getByTestId("report-group-row-cardio-export"),
+    ).toContainText("0/14");
+    // The fenced tier is not part of any one-click set.
+    await expect(
+      page.getByTestId("report-scope-summary-export"),
+    ).not.toContainText("incl.");
+  });
+
+  test("a share link cannot be minted on an empty scope either", async ({
+    page,
+  }) => {
+    await openGesundheitsakte(page);
+    const create = page.getByTestId("share-create-submit");
+    await expect(create).toBeVisible({ timeout: 10_000 });
+    await page.locator("#share-label").fill("Cardiology");
+    // A label alone is not a scope: the link would serve a page with nothing
+    // on it, so the control stays shut until something is chosen.
+    await expect(create).toBeDisabled();
+    await expect(page.getByTestId("report-scope-summary-share")).toContainText(
+      "Nothing selected yet",
+    );
+    await page.getByTestId("report-apply-standard-share").click();
+    await expect(create).toBeEnabled();
+  });
+
   test("clears the tap floor on the group rows at 390 px", async ({ page }) => {
     await page.setViewportSize({ width: 390, height: 844 });
     await openGesundheitsakte(page);

e2e/share-documents.spec.ts

@@ -51,9 +51,10 @@ interface CreatedShare {
 }
 
 /**
- * Drive the owner create flow: open the picker, isolate the share-fixture trio
- * by search, select all three, create the link, and read the one-time token +
- * passphrase off the reveal card. Also asserts the QR promotion.
+ * Drive the owner create flow: name the link, choose a record scope, open the
+ * picker, isolate the share-fixture trio by search, select all three, create
+ * the link, and read the one-time token + passphrase off the reveal card. Also
+ * asserts the QR promotion.
  */
 async function createShareWithDocs(page: Page): Promise<CreatedShare> {
   const label = `${SHARE_DOC_PREFIX} ${Date.now()}`;
@@ -67,6 +68,10 @@ async function createShareWithDocs(page: Page): Promise<CreatedShare> {
   await page.goto("/settings/sharing");
   await sharingDataReady;
   await page.locator("#share-label").fill(label);
+  // A record link starts with an empty scope and cannot be minted on one, so
+  // the scope is chosen here the way an owner chooses it: one click on the
+  // named standard set.
+  await page.getByTestId("report-apply-standard-share").click();
 
   // Open the document picker and isolate the seeded trio.
   await page.getByTestId("share-attach-open").click();