Fix date-key, 24-hour clock, query truncation, and API-key-in-URL bugs

[ak710]

Summary

Five independent bug fixes found while reading through the app. None of them are visible on a default US-locale device, which is roughly why they survived. Each commit stands alone and can be dropped or taken separately.

1. Date keys followed the device's calendar. DateFormatter inherits its calendar from the user's locale, so on a device set to the Buddhist or Japanese calendar (Settings → General → Language & Region → Calendar) "yyyy-MM-dd" renders 1 Aug 2026 as 2569-08-01 / 8-08-01. That is right for display and wrong for the seven strings it affected, which are identifiers: coach summary scope keys, the notification dedupe key, export/share-card filenames, and the date arguments the coach emits and parses back. A key that moves with the setting stops matching stored keys, stops sorting chronologically, and stops being a date the model can read back. Adds DateFormatter.stableKey, pinning en_US_POSIX + Gregorian — the combination BatteryAlertMonitor already used for its own dedupe key.

2. Six display sites hard-coded 12-hour time. "h:mm a" forces "9:30 PM" on users who have turned on 24-Hour Time, and in locales where 24-hour is the norm: sleep stage chart axis, sleep bed/wake times, workout summary header, meal detail, share card. Now locale templates ("jmm" → 9:30 PM or 21:30). Month/day patterns move to templates too, which also fixes field order per locale (Aug 1 vs 1 Aug).

3. Two windowed reads misbehaved. SleepRepository.latestSession sorted the whole SleepSession table to take .first with no fetchLimit, unlike every sibling in the file. MetricsRepository.batterySamples sorted forward then applied fetchLimit, so a window over the cap returned the oldest rows and dropped the newest — the opposite of what the drainage chart is for.

4. The Gemini API key travelled in the URL. ?key=... puts the user's credential in the part of a request that gets written down (URLSession logging, os_log, crash reports, proxies). Moved to the x-goog-api-key header, matching what the other three coach clients do. Interpolating also meant a key with a URL-special character failed URL(string:) and surfaced as a misleading "could not build endpoint URL".

5. PulseLoopWidgets was never linted, and DiagnosticsExporter built a fresh ISO8601DateFormatter inside the map over every log line and packet (up to ~700 per export).

Related issues

Type of change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 📟 New / improved wearable support (BLE driver layer)
• 🤖 Coach / LLM change (tools, prompts, orchestration)
• 🎨 UI / DesignSystem change
• 🧹 Refactor / chore (no behavior change)
• 📝 Docs only
• ⚠️ Breaking change (existing data, settings, or APIs change)

How was this tested?

• Added / updated unit tests (PulseLoopTests)
• Ran the test suite locally (⌘U in Xcode)
• Tested on a physical device with a real ring — model:
• Tested with demo data (-seedDemo YES, no hardware)
• N/A (docs / non-code change)

885 tests pass, swiftlint reports 0 errors (the widget files it now covers add 2 large_tuple warnings and no errors).

12 new tests across DateFormattingTests, RepositoryFetchLimitTests, and GeminiClientTests. Each was checked against the unfixed code first and fails there — e.g. reverting the two behavioural changes turns 5 of them red — so they are regression guards rather than restatements of current behaviour.

Not exercised on hardware: none of this touches the BLE layer. The riskiest change for a device check is #2, since it alters visible strings — the sleep chart axis and workout summary header are the places to look.

Privacy & data

• This change does not send health data off-device without explicit user action.
• No secrets, API keys, or personal data are committed.

Fix #4 strictly reduces exposure of the user's own API key.

Checklist

• My code follows the project's style (SwiftLint passes).
• I ran the tests and they pass.
• I updated docs / README where relevant.
• I read the Contributing guide.

---

Notes for review

CONTRIBUTING asks for one logical change per PR — these are five, kept as five separate commits for that reason. Happy to split into separate PRs if you'd prefer.

A few smaller things I noticed and deliberately left alone, since each needs a judgement call that is yours:

• CoachDataAccess.dayBounds returns next-midnight as end while the repository predicates use <= end, so a reading at exactly 00:00:00 is counted in both adjacent days. The fix is one character, but it shifts behaviour for every caller of those shared predicates.
• CoachDataAccess's day/time helpers still build a formatter per call inside maps over rows. Caching them means either a stale time zone or a per-call reset, so it wanted a decision rather than a drive-by.
• ForEach(sessions.indices, id: \.self) in SleepView and RecordSummaryViews uses index-as-identity over data that can reorder.