feat(symptoms): add person-defined symptoms and timestamped occurrences

A symptom of one's own ("aura", "headache") is a definition with an
encrypted name and an icon from the cycle custom-symptom allowlist; each
occurrence carries a time, a 0-10 intensity (the pain score's scale), an
optional encrypted note and an optional link to one of the record's open
illness episodes. Both ride the illness module: every route answers
illness.disabled when it is off.

- Migration 0369 (idempotent): symptom_definitions and symptom_events,
  intensity CHECK 0-10, episode link ON DELETE SET NULL.
- /api/symptoms/definitions{,/[id]} and /api/symptoms/events{,/[id]}:
  eight active definitions per record (a hidden one frees its slot,
  showing it again re-checks), hide or purge, events create/list/edit/
  delete, a new link must name an open episode of the same record
  (422 symptoms.episode.notOpen). Error group symptoms.*.
- Sharing: reads at READ, logging an occurrence at WRITE, defining and
  editing at MANAGE; C1/C3/C4 audit details; frozen lists, the handler
  matrix and the activity verbs updated.
- Both encrypted columns registered and rotated; both models in the wipe
  plan; both carried at both backup ends with occurrences nested in their
  definition, plaintext in a portable file and ciphertext in a recovery
  file, and a link to an episode the file lacks dropped and named
  (symptomEpisodeReference).
- OpenAPI regenerated.

src/lib/validations/backup.ts

@@ -1102,6 +1102,44 @@ const illnessEpisodeBackupSchema = z
   })
   .passthrough();
 
+/**
+ * A person-defined symptom (v1.40) with every occurrence of it nested inside,
+ * the way a medication carries its side effects. `label` / `labelEncrypted`
+ * and `note` / `noteEncrypted` are the two ends of the free-text contract: a
+ * portable file carries the plaintext, a disaster-recovery file the ciphertext.
+ * An occurrence's `episodeId` is the exported episode's own id; the restore
+ * nulls one that names an episode the file does not carry.
+ */
+const symptomEventBackupSchema = z
+  .object({
+    id: z.string().min(1).optional(),
+    occurredAt: isoDateTime,
+    intensity: z.number().int().min(0).max(10),
+    note: z.string().nullable().optional(),
+    noteEncrypted: base64BytesSchema.nullable().optional(),
+    episodeId: z.string().min(1).nullable().optional(),
+    createdAt: isoDateTime,
+    updatedAt: isoDateTime,
+  })
+  .passthrough();
+
+const symptomDefinitionBackupSchema = z
+  .object({
+    id: z.string().min(1).optional(),
+    label: z.string().min(1).optional(),
+    labelEncrypted: base64BytesSchema.optional(),
+    icon: z.string().nullable().optional(),
+    sortOrder: z.number().int(),
+    isActive: z.boolean(),
+    createdAt: isoDateTime,
+    updatedAt: isoDateTime,
+    events: z.array(symptomEventBackupSchema).default([]),
+  })
+  .passthrough()
+  .refine((d) => d.label !== undefined || d.labelEncrypted !== undefined, {
+    message: "A symptom definition needs a label or its ciphertext",
+  });
+
 /**
  * A practitioner, an encounter, and the edges between an encounter and the
  * things it produced.
@@ -1853,6 +1891,8 @@ export const backupPayloadSchema = z
     labResults: z.array(labResultBackupSchema).default([]),
     biomarkers: z.array(biomarkerBackupSchema).default([]),
     illnessEpisodes: z.array(illnessEpisodeBackupSchema).default([]),
+    // Defaulted: a file written before v1.40 carries no key.
+    symptomDefinitions: z.array(symptomDefinitionBackupSchema).default([]),
     allergies: z.array(allergyBackupSchema).default([]),
     familyHistory: z.array(familyHistoryBackupSchema).default([]),
     workouts: z.array(workoutBackupSchema).default([]),