feat: lay down the shared v1.42 contract

Land every file the v1.42 work shares before any of it is built, so the
parts built side by side never edit the same file.

Schema and migrations 0379-0386: the HEALTH_CONNECT measurement source,
ImportJob.kind, the air-quality columns and the per-user switch on the
environment tables, sealed environment locations with nullable plaintext,
managed-profile handover links, the per-type HealthKit arrival ledger, lab
unit-conversion provenance, and user-defined vaccines. Every new column is
annotated for the column-reader sweep.

HEALTH_CONNECT reaches every exhaustive list: the source labels, the
read enum (not the write allowlist), the source-priority ladder cap, now
the number of sources rather than a fixed eight, and the write-path smoke
test. RMSSD gets its own priority class and a 300 ms ceiling. The batch
syncTrigger gains `manual`, with its label on the Apple Health card.

Queues for the Health Connect import, the compaction-tombstone purge and
the measurement-table maintenance are registered with stub handlers;
host-metric sampling moves to every five minutes. Environment and work_mem
variables reach the compose whitelist, the production example and the
manifest. The proxy admits the handover link and redirects it at the edge,
and the Health Connect upload bypasses the proxy body limit.

The new routes answer 501 behind their final authentication and are
published in the contract; backup, wipe and key rotation classify the new
models and columns; the seven message bundles carry the base copy. Guards
that list release-pending keys and columns fail once an entry is wired, so
those lists empty themselves before the tag.

Also re-anchor a login-throttle fixture to the wall clock, where its
expiry is compared, and re-base the aggregate bundle cap on a measured
12 KB of new locale strings.

src/lib/validations/source-priority.ts

@@ -94,10 +94,14 @@ export type DeviceType = z.infer<typeof deviceTypeEnum>;
  * keys; lifted into a nested object so the schema has room for the new
  * `deviceTypePriority` sibling without clobbering the metric keys.
  *
- * The 8-entry cap is a sanity bound (we have 4 sources today, the cap
- * leaves headroom without inviting a megabyte-blob payload).
+ * The cap is the number of `MeasurementSource` values: a ladder may rank
+ * every source once, and no more. A fixed 8 stopped fitting once the
+ * longest default ladders reached eight entries and a ninth source
+ * (Health Connect, v1.42) had to be sortable into them.
  */
-const metricSourceLadder = z.array(measurementSourceEnum).max(8);
+const metricSourceLadder = z
+  .array(measurementSourceEnum)
+  .max(measurementSourceEnum.options.length);
 
 /**
  * Metric-class keys carried by `SourcePriority`. Listed once here so
@@ -144,6 +148,10 @@ export const SOURCE_PRIORITY_METRIC_KEYS = [
   // Laddering it now keeps the picker deterministic — and the choice user-
   // configurable, not WHOOP-hardcoded — the instant a native producer lands.
   "sleepDebt",
+  // v1.42 (#1110) — RMSSD HRV as its own class. WHOOP, Oura and Polar report
+  // RMSSD natively, Apple Health relays it from third-party apps; SDNN keeps
+  // the `hrv` ladder, since the two measures are not interchangeable.
+  "hrvRmssd",
 ] as const;
 
 export type SourcePriorityMetricKey =
@@ -395,6 +403,9 @@ export const DEFAULT_SOURCE_PRIORITY: Required<MetricPriority> = {
   // rolling-balance debt; the COMPUTED engine is the fallback every user lands
   // on now. Mirrors the recovery ladder's native-above-computed ordering.
   sleepDebt: ["WHOOP", "OURA", "POLAR", "COMPUTED"],
+  // v1.42 (#1110) — the straps and rings that measure RMSSD overnight lead;
+  // the HealthKit relay of a third-party reading is the fallback.
+  hrvRmssd: ["WHOOP", "OURA", "POLAR", "APPLE_HEALTH"],
 };
 
 /**