Read glucose and body weight back out of Apple Health

[ak710]

Closes #119

Merge order: 9 of 9. ⚠️ Stacked on #122 — this diff also contains that commit. Merge #122 first.

What

The Health integration only ever wrote. Reading is what makes CGM data work: a continuous glucose monitor writes bloodGlucose to Health, PulseLoop reads it, and from then on it sits in the same store the coach already queries beside the ring's sleep and heart rate. Oura's whole metabolic-health story is this read.

Import is its own opt-in, default off, separate from the export master toggle. "Show my ring data elsewhere" and "let other apps' data into mine" are different decisions with different privacy weight; one switch would make one of them implicit.

The loop guard

This is the part that needed most care. With #122 merged PulseLoop exports glucose and imports it, so unguarded one reading goes round forever: import → export as ours → import back → export again.

Guarded on both sides, because they fail differently:

1. Every read excludes this app's own HKSource.
2. Imported rows carry MeasurementSource.appleHealth, which the export predicates now exclude — three predicates in HealthSyncService needed that added.

Either alone would close the loop; both are in place, and a test pins each.

Dedup

Imported readings key on (kind, instant, imported) — the same rule every other history path uses. A CGM revising a reading in place updates the row rather than stacking a second beside it, and an unchanged re-import writes nothing.

An import never edits a ring row at the same instant: those are two claims about one moment, and the ring's isn't something an import may overwrite (testImportDoesNotTouchRingRowsAtTheSameInstant).

Values pass through RingEventBridge's own gate, so an implausible third-party reading is refused on exactly the same terms as an implausible ring one.

Deliberately not imported

Steps and workouts. Both double-count against ring data: Health's step count includes the iPhone's pedometer, and a ring workout PulseLoop exported would return as a second session. Merging those needs provenance-aware reconciliation this doesn't have, so it doesn't pretend to.

Body mass updates the profile, not a measurement row — that's where the calorie model and BMI already read weight from, and a second home would let the two disagree.

Import watermarks are a separate map from the export ones, so a full re-export never also re-imports a year of glucose.

Testing

HealthImportTests — 13 tests on provenance, dedup, the loop guard and prefs. Full suite green (895). Docs: docs/project/apple-health.md covers both directions.

⚠️ I don't have a CGM, so the live read path is unverified on device — the tests cover the dedup and provenance logic, which is where the correctness risk sits, but someone with a CGM confirming the end-to-end pull would be worth having.