refactor(query-keys): route long-tail surfaces through the factory

The settings / medications / admin / hooks tree still declared
bare-literal `queryKey: [ … ]` arrays at ~70 call sites. Centralise
them through `queryKeys.<entry>()` so mutation-invalidation prefixes
stay symmetrical and a future rename only touches one location.

New factory entries cover per-medication compliance / titration /
cadence / glp1-details / drug-level-chart / intake-list, the
Withings status read, the paginated admin audit-log filter, and the
workouts-recent list opts. Existing entries cover everything else
(passkeys, tokens, settings, telegram, integrations, research-mode,
admin status / users / backups / feedback / host-metrics / app-logs /
ai-quality / assistant-flags, coach-prefs, feature-flags, etc.).

Lockstep updates:

- `eslint-plugins/healthlog/queryKey-factory.js` extends
  `GUARDED_DIRECTORIES` to cover `src/components/{settings,
  medications,admin}` + `src/hooks`, plus the three guarded files
  under `src/app/medications/**` and `src/app/targets/page.tsx`.
- `src/lib/__tests__/query-keys.test.ts` mirrors the guard's
  `guardedRoots` and pins the shape of every new factory entry.

Tests stay green: 4 736 unit; the factory walker reports zero
bare-literal `queryKey:` in any newly-guarded surface.

eslint-plugins/healthlog/queryKey-factory.js

@@ -53,6 +53,13 @@ const GUARDED_DIRECTORIES = [
   // at the same boundary the unit-test walker does.
   "src/app/auth",
   "src/app/notifications",
+  // v1.4.42 W3-QUERYKEY-LONGTAIL — the settings / medications /
+  // admin / hooks surface is now factory-only. Every long-tail
+  // bare-literal flagged by audit-H1 routes through `queryKeys.<entry>()`.
+  "src/components/settings",
+  "src/components/medications",
+  "src/components/admin",
+  "src/hooks",
 ];
 
 // Individual guarded files outside the directories above.
@@ -61,6 +68,11 @@ const GUARDED_FILES = [
   "src/hooks/use-auth.ts",
   // v1.4.41 W-FRONTEND-FACTORY — about-section migrated.
   "src/components/settings/about-section.tsx",
+  // v1.4.42 W3-QUERYKEY-LONGTAIL — medications + targets pages now
+  // route every read through the factory.
+  "src/app/medications/page.tsx",
+  "src/app/medications/[id]/history/page.tsx",
+  "src/app/targets/page.tsx",
 ];
 
 function isGuarded(filename) {