feat(labs): add a hidden flag to the biomarker catalog

Add a `hidden` boolean to the Biomarker model (migration
0195_biomarker_hidden) so a marker the user no longer needs can be
soft-removed instead of deleted: it leaves the active catalog and the
lab-entry pickers but keeps its readings and canonical unit/range.

Thread `hidden` through the DTO, the update schema, the PUT handler
(field-by-field), and the list endpoint (visible markers first). Regen
the OpenAPI contract.

src/app/api/biomarkers/[id]/route.ts

@@ -39,6 +39,7 @@ function serialiseBiomarker(row: {
   lowerBound: number | null;
   upperBound: number | null;
   panel: string | null;
+  hidden: boolean;
   contextEncrypted: Uint8Array | null;
   createdAt: Date;
   updatedAt: Date;
@@ -54,6 +55,7 @@ function serialiseBiomarker(row: {
     context: row.contextEncrypted
       ? decryptContextFromBytes(row.contextEncrypted)
       : null,
+    hidden: row.hidden,
     createdAt: row.createdAt.toISOString(),
     updatedAt: row.updatedAt.toISOString(),
   };
@@ -137,6 +139,7 @@ export const PUT = apiHandler(
     if (d.lowerBound !== undefined) data.lowerBound = d.lowerBound;
     if (d.upperBound !== undefined) data.upperBound = d.upperBound;
     if (d.panel !== undefined) data.panel = d.panel;
+    if (d.hidden !== undefined) data.hidden = d.hidden;
 
     // Inverted-range guard for a PARTIAL bound update. The schema refine only
     // fires when both bounds arrive together; moving a single bound past the

src/app/api/biomarkers/route.ts

@@ -50,6 +50,7 @@ function serialiseBiomarker(row: {
   lowerBound: number | null;
   upperBound: number | null;
   panel: string | null;
+  hidden: boolean;
   contextEncrypted: Uint8Array | null;
   createdAt: Date;
   updatedAt: Date;
@@ -63,6 +64,7 @@ function serialiseBiomarker(row: {
     panel: row.panel,
     hasContext: row.contextEncrypted !== null,
     context: decryptContextSoft(row.contextEncrypted),
+    hidden: row.hidden,
     createdAt: row.createdAt.toISOString(),
     updatedAt: row.updatedAt.toISOString(),
   };
@@ -71,9 +73,11 @@ function serialiseBiomarker(row: {
 export const GET = apiHandler(async () => {
   const { user } = await requireAuth();
 
+  // Visible markers first, then hidden — the manager renders them in two
+  // sections and the lab-entry pickers drop the hidden tail client-side.
   const rows = await prisma.biomarker.findMany({
     where: { userId: user.id },
-    orderBy: [{ name: "asc" }],
+    orderBy: [{ hidden: "asc" }, { name: "asc" }],
   });
 
   annotate({