Merge release/v1.39.0 into feat/ai-routes-insights-coach

Brings in the jobs, stored-text and consent package and the extraction
routes. Conflicts resolved:

- The digest keeps its capability-driven reaction line and check-in,
  now through the shared `aiCapabilityForRecord`; the local copy of it
  is removed.
- The route inventories classify the extraction routes (documents,
  labs OCR, medication text, fenced chat and attachments) as actions;
  a capability call counts as the gate for the module inventory.
- With every caller moved, `requireAssistantSurface` and
  `AssistantDisabledError` are deleted. The `assistant.disabled.*`
  codes stay on the capability refusal, and the guard now asserts the
  retired gate is gone.
- `aiCapabilityToServe` answers whether stored model text may be shown
  from the record's own state, apart from who is reading.

Refs #975

src/lib/api-handler.ts

@@ -26,7 +26,6 @@ import {
   selectorNamesAnAccount,
   type ActingCarrier,
 } from "./auth/acting-carrier";
-import { AssistantDisabledError } from "./feature-flags";
 import { AiUnavailableError } from "./ai/capabilities/refusal";
 import { ConsentRequiredError } from "./ai/consent-guard";
 import { SCOPE_HEALTH_READ, SCOPE_HEALTH_WRITE } from "./mcp/oauth/config";
@@ -246,27 +245,10 @@ export function apiHandler<T extends (...args: any[]) => Promise<Response>>(
               { data: null, error: error.message, meta: error.meta },
               { status: error.status },
             );
-          } else if (error instanceof AssistantDisabledError) {
-            // v1.4.31 — operator has disabled the assistant surface.
-            // The 403 + `errorCode: "assistant.disabled.<surface>"`
-            // envelope is locked per
-            // `.planning/RESPONSE-TO-IOS-TEAM-2026-05-16.md` §3 R5.
-            // Older iOS clients that don't know the errorCode surface
-            // this as a generic 403; v1.4.31+ clients can branch on the
-            // errorCode to render an inline operator-disabled notice.
-            evt.setError(error);
-            response = NextResponse.json(
-              {
-                data: null,
-                error: error.message,
-                meta: { errorCode: error.errorCode },
-              },
-              { status: 403 },
-            );
           } else if (error instanceof ConsentRequiredError) {
             // v1.12.1 — server-side consent gate before external-LLM PHI
-            // egress on the operator's server-managed key. Mirrors the
-            // AssistantDisabledError envelope (403 + meta.errorCode) so the
+            // egress on the operator's server-managed key. 403 +
+            // meta.errorCode, like the capability refusal above, so the
             // iOS client renders an inline "grant consent" notice instead of
             // a generic failure.
             evt.setError(error);