feat(coach): goal / if-then plan memory + locale-keyed dashboard snapshot

Add a CoachPlan model: durable, user-scoped if-then implementation plans
the Coach proposes and the user confirms. The background memory-refresh
pass extracts plans the user agreed to and writes them as "proposed"; only
the user-facing PATCH on /api/coach/plans/[id] activates one. The free-text
cue / action / target are encrypted at rest with the shared Bytes codec;
metric, status and dates stay plain so the injection picker ranks without a
per-row decrypt. Active plans fold into the Coach snapshot's memory block
and survive the prompt-budget drop alongside facts. List, confirm and
soft-delete routes are Coach-gated and narrow the owner from the session.

Key the dashboard-snapshot query cell by locale so a locale switch reads
freshly localised tile copy on its own cell instead of serving the prior
locale's prose until the slot goes stale. The zero-arg key stays
byte-identical, so every prefix-based invalidation keeps reaching the
locale-keyed cells; the offline-banner and preloader match on the prefix.

Migration 0194 (additive CREATE TABLE). Encryption-rotation registry and
script cover the three new Bytes columns.

src/components/layout/offline-banner.tsx

@@ -68,8 +68,13 @@ export function OfflineBanner() {
   // v1.18.6 — when an offline install is showing last-synced data (the SW's
   // allowlisted read cache + the IndexedDB query persister hydrated the
   // dashboard snapshot), say so honestly rather than implying a blank screen.
-  const hasCachedData =
-    queryClient.getQueryData(queryKeys.dashboardSnapshot()) != null;
+  // v1.21.3 (b) — the snapshot cell is now locale-keyed, so match on the
+  // `["dashboard","snapshot"]` PREFIX (`getQueriesData`) rather than the
+  // exact zero-arg slot — any hydrated locale's snapshot proves cached data
+  // is present.
+  const hasCachedData = queryClient
+    .getQueriesData({ queryKey: queryKeys.dashboardSnapshot() })
+    .some(([, data]) => data != null);
 
   return (
     <div