feat(topics): compute topic overviews and topic pages on the server

GET /api/topics answers one entry per topic the record holds data for:
a headline value, a rule-based sentence and a 30-day sparkline.
GET /api/topics/{topic} answers a topic's signals with their usual
ranges, side-by-side series for a chosen window, the relationships
between its signals, 90-day trends, what it holds nothing for yet, and
its blocks (training load, lab markers with their trend, screener
trends, the cycle day).

Every figure comes from reads the metric pages already make: the local
daily values, the reconstructed nights, the mood score, computeLabTrend,
the training load and the screener trends. No model is involved. A
relationship says nothing below 14 paired days and is only called a
pattern at p < 0.05; a lab trend needs three readings spanning a year.

The preview is the viewer's own opt-in: with it off both routes answer
404 topics.preview_off. Topics, signals and blocks follow the record's
module switches and the sections the viewer's grant opens; the routes
read across sections, so a scoped grant is refused like the timeline.
/api/auth/me publishes the caller's opt-ins as previewFeatures.

src/hooks/use-auth.ts

@@ -24,6 +24,10 @@ import { storeTimezone } from "@/lib/timezone-mirror";
 import type { ModuleKey } from "@/lib/modules/registry";
 import type { AiCapabilities } from "@/lib/ai/capabilities/types";
 import type { CoachReasoningState } from "@/lib/ai/reasoning/resolve";
+import {
+  resolvePreviewFeatures,
+  type PreviewFeatures,
+} from "@/lib/settings/preview-features";
 import type { ModuleAccessState } from "@/lib/sharing/module-disclosure";
 import type { OnboardingStateDto } from "@/lib/onboarding/needs";
 import type { TourProgress } from "@/lib/onboarding/tour-progress";
@@ -254,6 +258,14 @@ export interface AuthUser {
    * server image that does not publish it.
    */
   coachReasoning?: CoachReasoningState | null;
+  /**
+   * The person's own preview opt-ins, resolved on the server: every
+   * flag present, off unless switched on in Settings > System > Preview
+   * features. Read through `usePreviewFeature`. Optional so existing
+   * fixtures stay valid; `fetchMe` coerces an absent block (an older server)
+   * to every flag off.
+   */
+  previewFeatures?: PreviewFeatures;
   /**
    * v1.36.0 — account sharing, resolved server-side. `accounts` is the
    * switcher's menu, `active` is the record this browser is inside (null when
@@ -477,6 +489,8 @@ export async function fetchMe(): Promise<AuthUser> {
       data.coachReasoning && typeof data.coachReasoning === "object"
         ? data.coachReasoning
         : null,
+    // An older server publishes no opt-ins; every preview stays off.
+    previewFeatures: resolvePreviewFeatures(data.previewFeatures),
     accountAccess,
     accountAccessStatus,
   };