feat(fhir): wire the German BfArM ATC locale toggle into the export route

The builder already accepts a germanAtc option that appends the BfArM ATC
URI after the WHO entry. Thread it from the health-record export route: an
explicit germanAtc flag on the selection payload wins, otherwise it derives
from a German-region locale. The WHO coding stays coding[0], byte-identical
and locale-independent, so a WHO-only consumer is unaffected.

Add the optional germanAtc field to the strict export selection schema and
regenerate the OpenAPI contract.

docs/api/openapi.yaml

@@ -148,6 +148,8 @@ paths:
                   type: boolean
                 includeAiSummary:
                   type: boolean
+                germanAtc:
+                  type: boolean
               required:
                 - format
               additionalProperties: false

src/app/api/export/health-record/route.ts

@@ -90,6 +90,10 @@ export const POST = apiHandler(async (request: NextRequest) => {
       request.headers.get("accept-language") ?? "",
     );
 
+  // BfArM ATC: an explicit selection flag wins; otherwise derive it from a
+  // German-region locale. The WHO ATC coding is unaffected either way.
+  const germanAtc = selection.germanAtc ?? locale === "de";
+
   const [data, userTz, userRow] = await Promise.all([
     collectDoctorReportData(user.id, range, { practiceName, sections }),
     resolveUserTimezone(user.id),
@@ -136,7 +140,12 @@ export const POST = apiHandler(async (request: NextRequest) => {
   });
 
   if (selection.format === "fhir") {
-    const bundle = buildFhirDocumentBundle(data, { insuranceNumber });
+    const bundle = buildFhirDocumentBundle(
+      data,
+      { insuranceNumber },
+      undefined,
+      { germanAtc },
+    );
     const json = JSON.stringify(bundle);
     annotate({
       meta: { format: "fhir", bytes: json.length, days: range.days },
@@ -178,7 +187,12 @@ export const POST = apiHandler(async (request: NextRequest) => {
   }
 
   // format === "package": one zip holding the PDF + FHIR Bundle + a README.
-  const bundle = buildFhirDocumentBundle(data, { insuranceNumber });
+  const bundle = buildFhirDocumentBundle(
+    data,
+    { insuranceNumber },
+    undefined,
+    { germanAtc },
+  );
   const readme = t("doctorReport.packageReadme");
   const zipped = zipSync(
     {

src/lib/validations/health-record-export.ts

@@ -97,6 +97,10 @@ export const exportSelectionSchema = z
     practiceName: z.string().max(120).optional(),
     includeCharts: z.boolean().optional(),
     includeAiSummary: z.boolean().optional(),
+    // FHIR only: additionally emit the German BfArM ATC URI alongside the WHO
+    // entry on each medication concept (WHO stays first, byte-identical). When
+    // omitted, the route derives it from a German-region locale.
+    germanAtc: z.boolean().optional(),
   })
   .strict();