[P1/high] feat(web): terms-clean health-capture foundation (Capacitor + HealthSource seam) — vires-ops#37

[cipher813]

Priority: P1 · Complexity: high

Part of the route-tracking arc (vires-ops EPIC #34); implements the buildable, terms-clean foundation of vires-ops#37 (automatic ruck capture). Not Closes — the native capture core is out-of-CI (see Remaining below).

What this delivers

Health capture is built at the correct architectural layer: just another route-derivation mode, reusing the existing SI RouteStats → applyStats pipeline rather than a parallel path.

• web/capacitor.config.ts — wraps the existing Vite PWA (webDir: dist); the PWA still builds/runs standalone. Adds @capacitor/core (dep) + @capacitor/cli (dev).
• web/src/lib/health.ts — the TypeScript seam: HealthSource interface, an SI normalizer for untrusted native records (normalizeWorkout), a workout → RouteStats projection, a Capacitor-native source that bridges a Health plugin, and an unavailable web fallback selected by Capacitor.isNativePlatform().
• web/src/components/RouteCapture.tsx — a native-only Health route mode listing recent hike/walk workouts; on selection it prefills distance/elevation/duration through the same applyStats used by trail/draw/GPX. The tab is hidden unless healthSource.isAvailable(), so the standalone web PWA is byte-unaffected.
• routeMode.ts / api.ts / api/schemas/workout.py — new health RouteSource; the backend RouteSource literal is widened to accept it (a 1-value enum change, not a load-path change — SI conversion + metabolic_cost_kj are identical regardless of source, so POST /api/workouts/activity behavior is unchanged).

Note on issue anchors

The issue references RuckForm.tsx / logRuck / POST /api/workouts/ruck; those were refactored into the generic ActivityForm.tsx / RouteCapture.tsx / logActivity → POST /api/workouts/activity seam. This PR targets the real code. The issue also asks for read-only prefill; the established route-capture UX prefills editable fields ("edit anything that looks off") — kept consistent here.

Validated locally (green)

• Frontend (Node 20.19): npm run build ✓, npm run lint (oxlint) ✓, npm run test (vitest) ✓ — 131 pass, +7 new (health.test.ts).
• Backend (Py 3.12): ruff check ✓, pytest ✓ — 365 pass, +1 new (test_activity_accepts_health_route_source).

Remaining — why DRAFT (out of this environment)

The actual on-device capture cannot be built or validated on a headless Linux box; it needs Apple/Android tooling + a device:

1. npx cap add ios / npx cap add android native project generation.
2. The Health plugin native code — a HealthKit workout query (iOS) + a Health Connect read (Android), mapping to the SI { distanceM, elevationGainM, durationS } this seam already consumes.
3. On-device permission prompt + reading real workouts.

To validate the buildable part: cd web && npm ci && npm run build && npm run lint && npm run test (Node ≥20.19) and, from the repo root, pytest.