fix(backend): flatten medication serialization (MedicationResponse)

Backend + frontend. Resolves the integration gap where the medication list/create
responses were deeply nested (fields inside medicationData.data JSON blob,
camelCase) while the frontend expected flat snake_case fields — so the
MedicationManager couldn't display real data.

Backend (models/medication.rs):
* New MedicationData struct: deserializes the camelCase JSON string stored in
  medicationData.data (sideEffects->side_effects, prescribedBy->prescribed_by,
  etc.). Tolerates missing keys via #[default].
* New MedicationResponse: flat snake_case, the wire format. From<Medication>
  deserializes the data blob, maps fields, synthesizes active=true (TODO: real
  active flag), formats timestamps as ISO 8601. Tolerates malformed blobs.
* Fixed MedicationRepository::update: the old dot-notation (medicationData.name)
  wrote into phantom paths because the stored shape is medicationData:{data:
  '<string>'}. Now loads the doc, deserializes the blob, applies overrides,
  re-serializes, and $sets the whole data string. Updates actually persist now.
* 4 new unit tests (MedicationData deser, defaults, MedicationResponse flatten,
  malformed-blob tolerance).

Handlers (handlers/medications.rs): create/list/get/update now return
MedicationResponse instead of the raw Medication model.

Frontend (types/api.ts): Medication interface reconciled to match
MedicationResponse (added id, profile_id, route, reason, side_effects,
prescribed_by/date, notes, tags; relaxed user_id to optional).

Verified: backend cargo fmt/build/clippy 0 warnings, 23 unit tests pass (was 19);
frontend npm build clean, 20 vitest tests pass.

backend/src/handlers/medications.rs

@@ -10,7 +10,7 @@ use crate::{
     config::AppState,
     models::medication::{
         CreateMedicationRequest, LogDoseRequest, Medication, MedicationDose, MedicationRepository,
-        UpdateMedicationRequest,
+        MedicationResponse, UpdateMedicationRequest,
     },
 };
 
@@ -25,7 +25,7 @@ pub async fn create_medication(
     State(state): State<AppState>,
     Extension(claims): Extension<Claims>,
     Json(req): Json<CreateMedicationRequest>,
-) -> Result<Json<Medication>, StatusCode> {
+) -> Result<Json<MedicationResponse>, StatusCode> {
     let database = state.db.get_database();
     let repo = MedicationRepository::new(database.collection("medications"));
 
@@ -77,7 +77,7 @@ pub async fn create_medication(
     };
 
     match repo.create(medication).await {
-        Ok(med) => Ok(Json(med)),
+        Ok(med) => Ok(Json(med.into())),
         Err(_) => Err(StatusCode::INTERNAL_SERVER_ERROR),
     }
 }
@@ -86,14 +86,17 @@ pub async fn list_medications(
     State(state): State<AppState>,
     Extension(claims): Extension<Claims>,
     Query(query): Query<ListMedicationsQuery>,
-) -> Result<Json<Vec<Medication>>, StatusCode> {
+) -> Result<Json<Vec<MedicationResponse>>, StatusCode> {
     let database = state.db.get_database();
     let repo = MedicationRepository::new(database.collection("medications"));
 
     let _limit = query.limit.unwrap_or(100);
 
     match repo.find_by_user(&claims.sub).await {
-        Ok(medications) => Ok(Json(medications)),
+        Ok(medications) => {
+            let resp: Vec<MedicationResponse> = medications.into_iter().map(Into::into).collect();
+            Ok(Json(resp))
+        }
         Err(_) => Err(StatusCode::INTERNAL_SERVER_ERROR),
     }
 }
@@ -102,13 +105,13 @@ pub async fn get_medication(
     State(state): State<AppState>,
     Extension(_claims): Extension<Claims>,
     Path(id): Path<String>,
-) -> Result<Json<Medication>, StatusCode> {
+) -> Result<Json<MedicationResponse>, StatusCode> {
     let database = state.db.get_database();
     let repo = MedicationRepository::new(database.collection("medications"));
 
     match ObjectId::parse_str(&id) {
         Ok(oid) => match repo.find_by_id(&oid).await {
-            Ok(Some(medication)) => Ok(Json(medication)),
+            Ok(Some(medication)) => Ok(Json(medication.into())),
             Ok(None) => Err(StatusCode::NOT_FOUND),
             Err(_) => Err(StatusCode::INTERNAL_SERVER_ERROR),
         },
@@ -121,13 +124,13 @@ pub async fn update_medication(
     Extension(_claims): Extension<Claims>,
     Path(id): Path<String>,
     Json(req): Json<UpdateMedicationRequest>,
-) -> Result<Json<Medication>, StatusCode> {
+) -> Result<Json<MedicationResponse>, StatusCode> {
     let database = state.db.get_database();
     let repo = MedicationRepository::new(database.collection("medications"));
 
     match ObjectId::parse_str(&id) {
         Ok(oid) => match repo.update(&oid, req).await {
-            Ok(Some(medication)) => Ok(Json(medication)),
+            Ok(Some(medication)) => Ok(Json(medication.into())),
             Ok(None) => Err(StatusCode::NOT_FOUND),
             Err(_) => Err(StatusCode::INTERNAL_SERVER_ERROR),
         },