chore(release): v1.4.49 — audit-backlog closure + server reminder suppression + diagnostic endpoint + analytics cold-path fix

Bundles the deferred v1.4.47 Mediums + Lows with the v1.4.48-deferred items
into a single release. Headline: server-side suppression of MEDICATION_REMINDER
APNs for iOS clients that own their local reminders (closes GH #206), a
push_attempts table backing /api/admin/notifications/diagnostic, and a sweep
of v1.4.48 QA forward-findings.

Performance (the user-visible win):
- /api/analytics cold-fallback path splits the heavy single-statement
  aggregate into two parallel queries. The linearly composable columns
  (count / min / max / mean) keep the full-partition scan; the windowed
  7 / 30 / 90-day avg / slope / r² columns take a 90-day outer cap so
  the planner does an index range scan on (user_id, type, measured_at)
  instead of a full-partition sequential scan. Output is bit-identical;
  cold slim slice drops from multi-second to sub-second on tenants with
  large measurement partitions.

Server-side notifications:
- GET + PATCH /api/auth/me/notification-prefs with deep-merge semantics.
  Initial category medication.clientManaged: boolean (default false). Cron
  medicationReminderJob skips dose-due APNs when the flag is true,
  emitting a medication_reminder.suppressed_client_managed wide-event
  annotation per skip.
- push_attempts table backs the diagnostic endpoint. Every APNS /
  Web-Push / Telegram / NTFY sender writes a fire-and-forget row.
  Daily 03:35 Europe/Berlin cleanup prunes rows older than 90 days.
- /api/admin/notifications/diagnostic — admin-only endpoint surfacing
  device APNs token presence (masked), channel config presence, and
  recent push attempts. Registered in OpenAPI.
- Per-channel APNs "Send test" button now fires with
  eventType: "MEDICATION_REMINDER" so the dispatcher's time-sensitive +
  priority-10 branch runs. A successful self-test now exercises the
  exact path production reminders take; an unsuccessful one points the
  user at iOS Settings → Time Sensitive Notifications rather than
  appearing to be a server-side bug.

Withings reliability:
- OAuth callback consumes the nonce atomically (delete-first with
  P2025 catch for the replay branch). The previous read-then-delete
  pattern allowed a race between two concurrent callbacks.
- ?reason=state redirect differentiated into csrf1 / replay / expired /
  cross_user so operators can tell mismatch types apart without DB
  shell access.
- connect endpoint rate-limited to 10/60s/user; row-create failures
  redirect to a consistent error surface.

Observability hardening:
- redactSensitiveFields(body) denylist helper covers password / token /
  secret / apiKey / authorization / csrfState / nonce, recursive,
  case-insensitive. Caught: /api/devices invalid_format issues were
  echoing apnsToken values verbatim into the audit log.
- sanitiseZodIssues(issues, { stripValuesFromMessage: true }) overload
  applied to 14 audit-log sites.

Migrations: 0079 (notification_prefs), 0080 (push_attempts).

Tests: 4815 → 5272 unit + integration. Workout-batch integration suite
that had been red on main since v1.4.45 (three release commits shipped
through it) now green again — updated to match v1.4.42 cross-source
dedup semantics.

Resolves PR #207.

src/app/api/auth/me/disable-coach/route.ts

@@ -9,7 +9,7 @@
  *
  * The toggle is reachable from Settings → Insights as a `<Switch>`
  * labelled "Hide Coach" / "Coach ausblenden". Default `false` (Coach
- * visible) — see migration `0076_v1447_user_disable_coach` for the
+ * visible) — see migration `0078_v1447_user_disable_coach` for the
  * column-level documentation.
  *
  * Idempotent. The endpoint always returns the resolved next-state
@@ -19,13 +19,22 @@
  * batch settings round-trips after a passkey re-pair and a tight
  * 5/min would surface as a 429 on a normal onboarding flow.
  */
+import { z } from "zod";
+
 import { apiHandler, requireAuth, HttpError } from "@/lib/api-handler";
-import { apiError, apiSuccess, getClientIp } from "@/lib/api-response";
+import {
+  apiError,
+  apiSuccess,
+  getClientIp,
+  returnAllZodIssues,
+} from "@/lib/api-response";
 import { annotate } from "@/lib/logging/context";
 import { auditLog } from "@/lib/auth/audit";
 import { prisma } from "@/lib/db";
 import { checkRateLimit, rateLimitHeaders } from "@/lib/rate-limit";
 
+const patchBodySchema = z.object({ disableCoach: z.boolean() });
+
 export const dynamic = "force-dynamic";
 
 const PATCH_RATE_LIMIT = 60;
@@ -72,19 +81,13 @@ export const PATCH = apiHandler(async (req: Request) => {
     throw new HttpError(422, "disable-coach.body.invalid_json");
   }
 
-  // Hand-rolled validation — single boolean field. Keeps the
-  // prompt-injection surface visibly empty in code review (no string
-  // ever reaches an LLM).
-  if (
-    !body ||
-    typeof body !== "object" ||
-    typeof (body as { disableCoach?: unknown }).disableCoach !== "boolean"
-  ) {
+  const parsed = patchBodySchema.safeParse(body);
+  if (!parsed.success) {
     annotate({ action: { name: "auth.me.disable-coach.patch.invalid_shape" } });
-    throw new HttpError(422, "disable-coach.body.invalid_shape");
+    return returnAllZodIssues(parsed.error, 422);
   }
 
-  const next = (body as { disableCoach: boolean }).disableCoach;
+  const next = parsed.data.disableCoach;
 
   const previous = await prisma.user.findUnique({
     where: { id: user.id },

src/app/api/auth/me/notification-prefs/__tests__/route.test.ts

@@ -0,0 +1,270 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+vi.mock("@/lib/db", () => ({
+  prisma: {
+    user: {
+      findUnique: vi.fn(),
+      update: vi.fn(),
+    },
+  },
+  toJson: <T,>(v: T) => v,
+}));
+
+vi.mock("@/lib/auth/session", () => ({ getSession: vi.fn() }));
+
+vi.mock("@/lib/auth/audit", () => ({
+  auditLog: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("@/lib/logging/transports", () => ({ emitIfSampled: vi.fn() }));
+
+vi.mock("@/lib/db-compat", () => ({
+  ensureDbCompatibility: vi.fn().mockResolvedValue(undefined),
+}));
+
+vi.mock("@/lib/rate-limit", () => ({
+  checkRateLimit: vi.fn().mockResolvedValue({
+    allowed: true,
+    remaining: 59,
+    resetAt: Date.now() + 60_000,
+  }),
+  rateLimitHeaders: () => ({}),
+}));
+
+vi.mock("next/headers", () => ({
+  headers: vi.fn(async () => ({ get: () => null })),
+  cookies: vi.fn(async () => ({
+    get: () => undefined,
+    set: () => {},
+    delete: () => {},
+  })),
+}));
+
+import { GET, PATCH } from "../route";
+import { prisma } from "@/lib/db";
+import { getSession } from "@/lib/auth/session";
+import { auditLog } from "@/lib/auth/audit";
+import { checkRateLimit } from "@/lib/rate-limit";
+
+const SESSION_OK = {
+  session: { id: "sess-1", expiresAt: new Date(Date.now() + 3_600_000) },
+  user: { id: "user-1", username: "marc", role: "USER" as const },
+};
+
+function mkPatch(body: unknown): Request {
+  return new Request("http://localhost/api/auth/me/notification-prefs", {
+    method: "PATCH",
+    body: JSON.stringify(body),
+    headers: { "Content-Type": "application/json" },
+  });
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+});
+
+describe("GET /api/auth/me/notification-prefs", () => {
+  it("rejects an unauthenticated request with 401", async () => {
+    vi.mocked(getSession).mockResolvedValue(null);
+
+    const res = await (GET as (r: Request) => Promise<Response>)(
+      new Request("http://localhost/api/auth/me/notification-prefs"),
+    );
+    expect(res.status).toBe(401);
+    expect(prisma.user.findUnique).not.toHaveBeenCalled();
+  });
+
+  it("returns the documented defaults for a fresh user (null row)", async () => {
+    vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
+    vi.mocked(prisma.user.findUnique).mockResolvedValue({
+      notificationPrefs: null,
+    } as never);
+
+    const res = await (GET as (r: Request) => Promise<Response>)(
+      new Request("http://localhost/api/auth/me/notification-prefs"),
+    );
+    expect(res.status).toBe(200);
+    const env = (await res.json()) as {
+      data: { medication: { clientManaged: boolean } };
+    };
+    expect(env.data).toEqual({ medication: { clientManaged: false } });
+  });
+
+  it("returns the resolved prefs when the row holds a value", async () => {
+    vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
+    vi.mocked(prisma.user.findUnique).mockResolvedValue({
+      notificationPrefs: { medication: { clientManaged: true } },
+    } as never);
+
+    const res = await (GET as (r: Request) => Promise<Response>)(
+      new Request("http://localhost/api/auth/me/notification-prefs"),
+    );
+    expect(res.status).toBe(200);
+    const env = (await res.json()) as {
+      data: { medication: { clientManaged: boolean } };
+    };
+    expect(env.data).toEqual({ medication: { clientManaged: true } });
+  });
+
+  it("returns defaults when the persisted shape has drifted", async () => {
+    // Forward-compat: an admin hand-edit / future-rename should not
+    // crash the GET.
+    vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
+    vi.mocked(prisma.user.findUnique).mockResolvedValue({
+      notificationPrefs: { unknownCategory: { foo: "bar" } },
+    } as never);
+
+    const res = await (GET as (r: Request) => Promise<Response>)(
+      new Request("http://localhost/api/auth/me/notification-prefs"),
+    );
+    expect(res.status).toBe(200);
+    const env = (await res.json()) as {
+      data: { medication: { clientManaged: boolean } };
+    };
+    expect(env.data).toEqual({ medication: { clientManaged: false } });
+  });
+});
+
+describe("PATCH /api/auth/me/notification-prefs", () => {
+  it("rejects an unauthenticated request with 401", async () => {
+    vi.mocked(getSession).mockResolvedValue(null);
+
+    const res = await (PATCH as (r: Request) => Promise<Response>)(
+      mkPatch({ medication: { clientManaged: true } }),
+    );
+    expect(res.status).toBe(401);
+    expect(prisma.user.update).not.toHaveBeenCalled();
+  });
+
+  it("flips medication.clientManaged on and writes the audit row", async () => {
+    vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
+    vi.mocked(prisma.user.findUnique).mockResolvedValue({
+      notificationPrefs: null,
+    } as never);
+    vi.mocked(prisma.user.update).mockResolvedValue({} as never);
+
+    const res = await (PATCH as (r: Request) => Promise<Response>)(
+      mkPatch({ medication: { clientManaged: true } }),
+    );
+    expect(res.status).toBe(200);
+    const env = (await res.json()) as {
+      data: { medication: { clientManaged: boolean } };
+    };
+    expect(env.data).toEqual({ medication: { clientManaged: true } });
+
+    expect(prisma.user.update).toHaveBeenCalledWith({
+      where: { id: "user-1" },
+      data: {
+        notificationPrefs: { medication: { clientManaged: true } },
+      },
+    });
+
+    expect(auditLog).toHaveBeenCalledWith(
+      "user.notification-prefs.update",
+      expect.objectContaining({
+        userId: "user-1",
+        details: expect.objectContaining({
+          previous: { medication: { clientManaged: false } },
+          next: { medication: { clientManaged: true } },
+          changed: ["medication"],
+        }),
+      }),
+    );
+  });
+
+  it("rejects malformed JSON with 422", async () => {
+    vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
+
+    const req = new Request(
+      "http://localhost/api/auth/me/notification-prefs",
+      {
+        method: "PATCH",
+        body: "{ not valid json",
+        headers: { "Content-Type": "application/json" },
+      },
+    );
+
+    const res = await (PATCH as (r: Request) => Promise<Response>)(req);
+    expect(res.status).toBe(422);
+    expect(prisma.user.update).not.toHaveBeenCalled();
+  });
+
+  it("rejects a non-boolean clientManaged with 422", async () => {
+    vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
+
+    const res = await (PATCH as (r: Request) => Promise<Response>)(
+      mkPatch({ medication: { clientManaged: "yes" } }),
+    );
+    expect(res.status).toBe(422);
+    expect(prisma.user.update).not.toHaveBeenCalled();
+  });
+
+  it("deep-merges over existing siblings without overwriting them", async () => {
+    // Forward-compat: a row that already carries an unknown sibling
+    // category (e.g. a future "mood" key persisted by a newer client)
+    // must survive a PATCH that only touches `medication`. The route
+    // parses with the current zod schema first, then deep-merges the
+    // input over the parsed (defaulted) base. Today, "unknown sibling"
+    // resolves back to defaults; the test pins that the medication
+    // PATCH still lands and that future schema growth (adding new
+    // siblings to the zod shape) will preserve them.
+    vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
+    vi.mocked(prisma.user.findUnique).mockResolvedValue({
+      notificationPrefs: { medication: { clientManaged: false } },
+    } as never);
+    vi.mocked(prisma.user.update).mockResolvedValue({} as never);
+
+    const res = await (PATCH as (r: Request) => Promise<Response>)(
+      mkPatch({ medication: { clientManaged: true } }),
+    );
+    expect(res.status).toBe(200);
+
+    expect(prisma.user.update).toHaveBeenCalledWith({
+      where: { id: "user-1" },
+      data: {
+        notificationPrefs: { medication: { clientManaged: true } },
+      },
+    });
+  });
+
+  it("returns the merged shape unchanged on an empty PATCH body", async () => {
+    // Idempotent — an empty body keeps the row as-is and still writes
+    // the audit trail (mirrors the disable-coach posture).
+    vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
+    vi.mocked(prisma.user.findUnique).mockResolvedValue({
+      notificationPrefs: { medication: { clientManaged: true } },
+    } as never);
+    vi.mocked(prisma.user.update).mockResolvedValue({} as never);
+
+    const res = await (PATCH as (r: Request) => Promise<Response>)(
+      mkPatch({}),
+    );
+    expect(res.status).toBe(200);
+    const env = (await res.json()) as {
+      data: { medication: { clientManaged: boolean } };
+    };
+    expect(env.data).toEqual({ medication: { clientManaged: true } });
+
+    expect(prisma.user.update).toHaveBeenCalledWith({
+      where: { id: "user-1" },
+      data: {
+        notificationPrefs: { medication: { clientManaged: true } },
+      },
+    });
+  });
+
+  it("returns 429 when the per-user rate-limit fires", async () => {
+    vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
+    vi.mocked(checkRateLimit).mockResolvedValueOnce({
+      allowed: false,
+      remaining: 0,
+      resetAt: Date.now() + 30_000,
+    });
+
+    const res = await (PATCH as (r: Request) => Promise<Response>)(
+      mkPatch({ medication: { clientManaged: true } }),
+    );
+    expect(res.status).toBe(429);
+    expect(prisma.user.update).not.toHaveBeenCalled();
+  });
+});

src/app/api/auth/me/notification-prefs/route.ts

@@ -0,0 +1,133 @@
+/**
+ * v1.4.49 M-DOUBLE-REMINDER — per-user notification preferences endpoint.
+ *
+ *  GET    /api/auth/me/notification-prefs  — current resolved prefs.
+ *  PATCH  /api/auth/me/notification-prefs  — body `{ medication?: { clientManaged?: boolean } }`.
+ *                                            Deep-merges the supplied
+ *                                            shape over the persisted
+ *                                            row so future categories
+ *                                            slot in next to
+ *                                            `medication` without
+ *                                            overwriting siblings.
+ *
+ * Auth is shared via `requireAuth()` so cookie sessions + Bearer
+ * tokens both work (the iOS app uses Bearer). Default shape lives in
+ * `parseNotificationPrefs` — a null DB row resolves to
+ * `{ medication: { clientManaged: false } }`, preserving the legacy
+ * server-side reminder behaviour for any user the iOS client has not
+ * yet opted in.
+ *
+ * Idempotent. The endpoint always returns the fully-resolved next
+ * state so the client can hard-set the optimistic update without an
+ * extra round-trip. Rate-limit is intentionally generous (60/min) —
+ * matches the disable-coach route which is the closest analogue.
+ */
+import { apiHandler, requireAuth, HttpError } from "@/lib/api-handler";
+import {
+  apiError,
+  apiSuccess,
+  getClientIp,
+  returnAllZodIssues,
+} from "@/lib/api-response";
+import { annotate } from "@/lib/logging/context";
+import { auditLog } from "@/lib/auth/audit";
+import { prisma, toJson } from "@/lib/db";
+import { checkRateLimit, rateLimitHeaders } from "@/lib/rate-limit";
+import {
+  notificationPrefsSchema,
+  parseNotificationPrefs,
+  resolveNotificationPrefs,
+} from "@/lib/validations/notification-prefs";
+
+export const dynamic = "force-dynamic";
+
+const PATCH_RATE_LIMIT = 60;
+const PATCH_WINDOW_MS = 60_000;
+
+export const GET = apiHandler(async () => {
+  const { user } = await requireAuth();
+  annotate({ action: { name: "auth.me.notification-prefs.get" } });
+
+  const row = await prisma.user.findUnique({
+    where: { id: user.id },
+    select: { notificationPrefs: true },
+  });
+  return apiSuccess(parseNotificationPrefs(row?.notificationPrefs ?? null));
+});
+
+export const PATCH = apiHandler(async (req: Request) => {
+  const { user } = await requireAuth();
+
+  const rl = await checkRateLimit(
+    `notification-prefs:patch:${user.id}`,
+    PATCH_RATE_LIMIT,
+    PATCH_WINDOW_MS,
+  );
+  if (!rl.allowed) {
+    const response = apiError("Too many requests", 429);
+    for (const [k, v] of Object.entries(rateLimitHeaders(rl))) {
+      response.headers.set(k, v);
+    }
+    return response;
+  }
+
+  let body: unknown;
+  try {
+    body = await req.json();
+  } catch {
+    throw new HttpError(422, "notification-prefs.body.invalid_json");
+  }
+
+  const parsed = notificationPrefsSchema.safeParse(body ?? {});
+  if (!parsed.success) {
+    annotate({
+      action: { name: "auth.me.notification-prefs.patch.invalid_shape" },
+      meta: { issues: parsed.error.issues.length },
+    });
+    return returnAllZodIssues(parsed.error, 422);
+  }
+
+  // Deep-merge the partial input over the current row so a PATCH that
+  // only touches `medication` does not overwrite future sibling
+  // categories (mood, personal_records, ...). The full resolved shape
+  // is persisted so the column layout stays stable across schema
+  // additions.
+  const current = await prisma.user.findUnique({
+    where: { id: user.id },
+    select: { notificationPrefs: true },
+  });
+  const previous = parseNotificationPrefs(current?.notificationPrefs ?? null);
+  const merged = resolveNotificationPrefs(
+    current?.notificationPrefs ?? null,
+    parsed.data,
+  );
+
+  await prisma.user.update({
+    where: { id: user.id },
+    data: { notificationPrefs: toJson(merged) },
+  });
+
+  // Capture which categories the PATCH actually touched so the audit
+  // trail records the user's intent, not just the full resolved row.
+  const changedCategories = Object.keys(parsed.data);
+
+  await auditLog("user.notification-prefs.update", {
+    userId: user.id,
+    ipAddress: getClientIp(req),
+    details: {
+      previous,
+      next: merged,
+      changed: changedCategories,
+    },
+  });
+
+  annotate({
+    action: { name: "user.notification_prefs.update" },
+    meta: {
+      changed: changedCategories,
+      medication_client_managed: merged.medication.clientManaged,
+    },
+  });
+
+  return apiSuccess(merged);
+});

src/app/api/auth/me/route.ts

@@ -34,7 +34,7 @@ export const GET = apiHandler(async () => {
     lastReportPracticeName: user.lastReportPracticeName ?? null,
     // v1.4.47 W3 — per-user Coach opt-out. Default `false` if the
     // column is absent (partial-deploy rollback safety, see migration
-    // 0076 commentary). Every Coach mount point on the client checks
+    // 0078 commentary). Every Coach mount point on the client checks
     // `user.disableCoach` BELOW the operator-level `flags.coach`
     // short-circuit; both gates must agree to paint the affordance.
     disableCoach: user.disableCoach ?? false,