Register eleven served routes in the OpenAPI contract

Eleven routes the native client calls have never been in the registry, so
`docs/api/openapi.yaml` does not describe them. Nothing caught it:
`openapi:check` compares the registry against the YAML and never compares
the route tree against the registry, so a route registered nowhere drifts
with every gate green.

  GET       /api/analytics
  GET,POST  /api/cycle/symptoms/custom
  GET       /api/dashboard/summary
  GET       /api/environment
  GET       /api/export
  GET,PUT   /api/insights/settings
  GET       /api/insights/targets
  GET,POST  /api/medications/intake
  GET,POST  /api/medications/{id}/glp1
  GET       /api/mood/insights
  GET       /api/personal-records

Each contract is derived from the handler rather than from its comments:
the methods it exports, the parameters it reads with their real defaults
and bounds, the statuses it can actually produce, whether it resolves the
record fence, and which module gate it sits behind. Where the answer is
awkward it is written down rather than smoothed over — `/api/export`
answers a bare `data` key and not the standard envelope; `/api/analytics`
serves two unrelated shapes behind one query parameter and records the
health score it computes; `GET /api/medications/intake?scope=today`
projects rows before it reads them; the GLP-1 GET is not delegable while
the POST on the same path is; and `highlightInsight` on the dashboard
summary is pinned null by the handler and has never carried anything.

The intake aggregator's query and body schemas move from inside the
handler to `@/lib/validations/medication`, so the contract generates from
the same object the route parses with instead of a second copy of it. The
environmental overview gets its own route module because nothing owns that
surface. `docs/api/openapi.yaml` is regenerated separately.

src/app/api/medications/intake/route.ts

@@ -12,7 +12,6 @@
  *     Updates the named MedicationIntakeEvent and returns the updated row.
  */
 import { NextRequest } from "next/server";
-import { z } from "zod/v4";
 import { apiHandler, requireRecordAuth } from "@/lib/api-handler";
 import {
   apiError,
@@ -46,7 +45,8 @@ import {
   restoreForIntake,
 } from "@/lib/medications/inventory/consumption";
 import {
-  injectionSiteEnum,
+  intakeAggregateQuerySchema,
+  intakeStatusUpdateSchema,
   type InjectionSiteValue,
 } from "@/lib/validations/medication";
 import { queueMedicationIntakeSync } from "@/lib/notifications/medication-intake-sync";
@@ -54,40 +54,15 @@ import { dispatchMedicationIntakeWebClear } from "@/lib/notifications/web-push-c
 import { notifyDelegatedIntake } from "@/lib/notifications/delegated-intake";
 import { countOutstandingDosesToday } from "@/lib/medications/outstanding-doses";
 
-const querySchema = z.object({
-  scope: z.enum(["today", "compliance"]),
-  days: z.coerce.number().int().min(1).max(365).optional().default(30),
-});
-
-const updateSchema = z.object({
-  intakeId: z.string().min(1),
-  status: z.enum(["taken", "skipped", "snoozed"]),
-  takenAt: z.iso
-    .datetime({ offset: true })
-    .transform((s) => new Date(s))
-    .optional(),
-  snoozedUntil: z.iso
-    .datetime({ offset: true })
-    .transform((s) => new Date(s))
-    .optional(),
-  // v1.8.5 — optional injection site captured alongside a "taken"
-  // status toggle. Validated server-side against the medication's
-  // effective allowed set; ignored for skipped / snoozed.
-  injectionSite: injectionSiteEnum.optional(),
-  // v1.15.18 — late-take "attribute anyway" pin. When a "taken" toggle lands
-  // outside every dose window the UI can offer to pin the take onto a chosen
-  // real slot ("diesem Slot zuordnen?"); the server validates the instant is
-  // a real slot of the medication (422 otherwise). Ignored for skip / snooze.
-  forceSlotInstant: z.iso
-    .datetime({ offset: true })
-    .transform((s) => new Date(s))
-    .optional(),
-});
+// The query + body schemas moved to `@/lib/validations/medication` when this
+// endpoint joined the published contract: the OpenAPI registry generates from
+// the validation modules, and a schema that only exists inside a handler is
+// one the spec has to restate — which is a second copy to keep in step.
 
 export const GET = apiHandler(async (request: NextRequest) => {
   const { user } = await requireRecordAuth("read", "medications");
 
-  const parsed = querySchema.safeParse(
+  const parsed = intakeAggregateQuerySchema.safeParse(
     Object.fromEntries(request.nextUrl.searchParams),
   );
   if (!parsed.success) {
@@ -233,7 +208,7 @@ export const POST = apiHandler(async (request: NextRequest) => {
   });
   if (error) return error;
 
-  const parsed = updateSchema.safeParse(body);
+  const parsed = intakeStatusUpdateSchema.safeParse(body);
   if (!parsed.success) {
     // v1.4.43 W6 — intake-event update hot path; multi-issue 422 +
     // audit breadcrumb keyed `medications.intake.update.validation-failed`.