feat(api): publish the resolved notification preferences on the account payload

The medication detail's notification section decides between the
server-side reminder switch and the client-managed chip on
`notificationPrefs.medication.clientManaged`, read off `GET /api/auth/me`.
That payload never carried the field — the preferences live on their own
endpoint, which is not on the app-boot path — so the flag was `undefined`
for every account: the chip never rendered, and a person whose phone owns
the reminders was shown a switch that no longer decides anything. The
write path and the dispatch gate were correct the whole time; only the
web reflection was missing its end.

The payload now carries the fully-resolved block from the same resolver
the dedicated endpoint uses, so the two cannot disagree, and an account
that never opted in reads `false` rather than absent. No extra query: the
session already loads the row the column sits on.

The pair guard over this payload gained the direction that could not see
it. It asked that every published field has a reader; a reader with no
field was invisible. It now also reads the response types clients declare
for this endpoint and holds them against what the route publishes. A
typed guard was tried first and does not work here — each consumer
declares its own local interface, so the compiler checks every file
against its own private claim and agrees with all of them.

src/lib/openapi/routes/account-sharing.ts

@@ -426,6 +426,17 @@ const accountPayload = z
     username: z.string(),
     accountAccess: accountAccessBlock,
     recordSession: recordSessionState.nullable(),
+    // Enumerated because a client DECIDES on it rather than displays it: the
+    // medication surface hides the server-side reminder switch when
+    // `medication.clientManaged` is true, because the phone owns those
+    // reminders and a switch that no longer decides anything is worse than no
+    // switch. Always fully resolved — an account that never opted in reads
+    // `false`, not absent. `PATCH /api/auth/me/notification-prefs` writes it;
+    // the categories this object does not name are the rest of the open
+    // preference envelope.
+    notificationPrefs: z.looseObject({
+      medication: z.looseObject({ clientManaged: z.boolean() }),
+    }),
   })
   .meta({
     id: "AccountPayload",