[Feature] Apple Health context import #43

Outcome

Import source-attributed Apple Health context so users can understand glucose alongside sleep, workouts, movement, heart rate, and historical glucose.

Dependencies

• Blocked on source identity, deduplication, deletion, and sync-anchor support in [Feature] Source-aware health data spine and import identity #36.
• Must reuse the shared normalized import contract also used by Health Connect.

Delivery stages

1. Bounded, user-triggered import with progressive per-type permissions.
2. Incremental HKAnchoredObjectQuery synchronization and deletion reconciliation.
3. Background/observer refresh after foreground correctness and battery behavior are verified.

Initial data types

• Sleep intervals and stages.
• Workouts.
• Steps, exercise time, active energy, and walking/running distance.
• Heart rate, then resting heart rate and HRV.
• Historical blood glucose, excluding OpenGlucose's own exported source.

Later, only with source-quality evidence: respiratory rate and oxygen.

Product behavior

• Per-type enable/disable, last successful sync, source summary, accessible-data state, and retry.
• Request permission only when a person enables the related context.
• Use “No accessible data” when HealthKit cannot distinguish denied from empty.
• Never blindly sum overlapping Watch, iPhone, Oura, Whoop, or other sources.
• Sample/demo mode never reads or persists personal HealthKit data.

Parallelization

After #36 freezes the import identity contract, iOS native import and mapping can run in parallel with journal UI and Health Connect. Coordinate HealthKit entitlement/Info.plist changes with release work.

Acceptance criteria

• Repeated bounded and anchored imports create zero duplicates.
• Added, updated, and deleted HealthKit objects reconcile correctly.
• Each datum preserves HealthKit UUID, source bundle/name, device, interval, and recording method.
• OpenGlucose-exported glucose is excluded from re-import.
• Progressive permission, no-accessible-data, partial failure, and retry UX are tested.
• Source overlap policy is deterministic and visible on drill-down.
• Background work is bounded and measured for battery impact.
• Physical-device tests cover DST, multiple sources, locked device, revocation, deletion, and app reinstall/update.
• Privacy/data-flow docs and R2 independent review are complete.