fix(measurements): validate single-POST source against the writable allowlist

WRITABLE_MEASUREMENT_SOURCES was a dead export whose docblock claimed it
gated the single-entry POST, but the schema only refined out COMPUTED —
WITHINGS and IMPORT stayed client-writable, so a client could attribute a row
to a source the server owns (the Withings webhook / CSV importer) and pollute
the per-source canonical picker. Wire createMeasurementSchema.source to a Zod
enum built from the now-correct {MANUAL, APPLE_HEALTH} allowlist; the enum
subsumes the old COMPUTED refine. Regenerate the OpenAPI contract.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docs/api/openapi.yaml

@@ -555,10 +555,7 @@ paths:
                   type: string
                   enum:
                     - MANUAL
-                    - WITHINGS
-                    - IMPORT
                     - APPLE_HEALTH
-                    - COMPUTED
                 glucoseContext:
                   type: string
                   enum: