feat(capabilities): advertise the FHIR REST face and share-link surface

Add a single canonical FHIR_REST_RESOURCE_TYPES catalogue (plus the
$everything operation and honoured search params) to fhir/rest.ts; the
metadata CapabilityStatement and the share-link resource-type enum now
derive from it so the advertised set can never drift from what is routed.

Extend GET /api/meta/capabilities with the FHIR REST descriptor
(restBaseUrl, readScope, resourceTypes, operations, searchParams) and a
clinician-share descriptor (supported, maxDays, resourceTypes, scopeable
sections) — every list sourced from its canonical registry, guarded by
the existing drift assertions. Grow the OpenAPI CapabilitiesResponse to
match.

Fill the clinician test-matrix gap: assert the clinician view never
requests a KVNR / identifier opt-in from the aggregator (default-OFF by
construction) and resolves a rolling window without reaching data older
than the frozen start.

src/lib/openapi/routes.ts

@@ -1952,8 +1952,40 @@ const capabilitiesResponse = z
         germanAtcDefaultLocales: z
           .array(z.string())
           .describe("App locales that default the additive BfArM ATC coding on."),
+        restBaseUrl: z
+          .string()
+          .describe("Base path of the read-only FHIR R4 REST face."),
+        readScope: z
+          .string()
+          .describe("Bearer scope a narrow token needs to read the FHIR face."),
+        resourceTypes: z
+          .array(z.string())
+          .describe("FHIR resource types the REST face serves (read + search)."),
+        operations: z
+          .array(z.string())
+          .describe("Whole-record operations exposed (e.g. $everything)."),
+        searchParams: z
+          .array(z.string())
+          .describe("Search parameters honoured uniformly across the search routes."),
       })
-      .describe("FHIR coding constants the health-record export emits."),
+      .describe(
+        "FHIR coding constants + the read-only REST face descriptor (v1.11).",
+      ),
+    share: z
+      .object({
+        supported: z.boolean().describe("Whether clinician share links are served."),
+        maxDays: z
+          .number()
+          .int()
+          .describe("Maximum lifetime of a share link, in days. No never-expiring share."),
+        resourceTypes: z
+          .array(z.string())
+          .describe("FHIR resource types a share link may be scoped to serve."),
+        sections: z
+          .array(z.string())
+          .describe("Scopeable report sections a share link may toggle."),
+      })
+      .describe("Clinician share-link surface descriptor (v1.11)."),
   })
   .meta({
     id: "CapabilitiesResponse",