test: E2E ZK integration tests + frontend lifecycle test

Backend ZK integration tests (tests/zk_integration_tests.rs):
- medication_stored_as_ciphertext: register → create med with opaque blob →
  response echoes blob, no plaintext fields leaked → GET echoes blob.
- appointment_stored_as_ciphertext_with_top_level_status: opaque blob + status
  filter works server-side without decryption.
- health_stat_stored_as_ciphertext: opaque blob, no value/stat_type leaked.
- dose_schedule_adherence_reflects_missed_doses: 1×/day schedule → 30 scheduled,
  1 taken, 29 missed, ~3.3% rate.

Updated medication_tests.rs for the opaque-blob contract (was sending old
plaintext name/dosage fields).

Frontend lifecycle test (useStore.test.ts):
- Full ZK round-trip with real WebCrypto: setup → encrypt → verify ciphertext →
  unlock with password → decrypt → recover via phrase → rewrap under new
  password → decrypt with new key. Data survives the full lifecycle.

Verified: backend 24 tests 0 warnings; frontend 25 tests, build clean.

backend/tests/medication_tests.rs

@@ -2,7 +2,7 @@
 //!
 //! In-process against an isolated MongoDB test DB (see `common`). When Mongo is
 //! unreachable these skip gracefully. Verifies auth enforcement and an
-//! authenticated create -> list flow with the actual API contract.
+//! authenticated create -> list flow with the zero-knowledge opaque-blob contract.
 
 mod common;
 
@@ -29,9 +29,10 @@ async fn create_medication_requires_auth() {
         &app,
         "POST",
         "/api/medications",
-        Some(
-            json!({ "name": "Test Med", "dosage": "10mg", "frequency": "daily", "route": "oral" }),
-        ),
+        Some(json!({
+            "profile_id": "default",
+            "encrypted_data": { "data": "Y3QA==", "iv": "aXY=" },
+        })),
         None,
     )
     .await;
@@ -84,16 +85,15 @@ async fn authenticated_user_can_create_and_list_medication() {
     assert_eq!(status, 201);
     let token = body["token"].as_str().unwrap().to_string();
 
-    // Create a medication (name/dosage/frequency/route are all required).
+    // Create a medication with an opaque encrypted blob (zero-knowledge).
+    let opaque = "Y2lwaGVydGV4dA==";
     let (status, body) = common::send_json(
         &app,
         "POST",
         "/api/medications",
         Some(json!({
-            "name": "Ibuprofen",
-            "dosage": "200mg",
-            "frequency": "as needed",
-            "route": "oral"
+            "profile_id": "default",
+            "encrypted_data": { "data": opaque, "iv": "aXY=" },
         })),
         Some(&token),
     )
@@ -102,8 +102,11 @@ async fn authenticated_user_can_create_and_list_medication() {
         status == 200 || status == 201,
         "create should succeed, body: {body}"
     );
+    // Response should echo the opaque blob, not expose plaintext fields.
+    assert_eq!(body["encrypted_data"]["data"], opaque);
+    assert!(body.get("name").is_none(), "server leaked plaintext");
 
-    // List medications for the user — should include the one we just created.
+    // List medications — should include the one we just created.
     let (status, body) =
         common::send_json(&app, "GET", "/api/medications", None, Some(&token)).await;
     assert_eq!(status, 200, "list should succeed, body: {body}");
@@ -113,6 +116,12 @@ async fn authenticated_user_can_create_and_list_medication() {
         !arr.is_empty(),
         "list should contain the created medication"
     );
+    // Each list item should be opaque.
+    assert!(
+        arr[0].get("encrypted_data").is_some(),
+        "list item has encrypted_data"
+    );
+    assert!(arr[0].get("name").is_none(), "list item leaked plaintext");
 
     common::drop_test_db(&db_name).await;
 }