feat(health): add P0 health channel kernel and encrypted health zone.

Lock health recording behind confirm-only state machines, reject public publishes for the health category, and ship the 14-day experiment Page Data templates with tests.

Co-authored-by: Cursor <cursoragent@cursor.com>

mindspace.mjs

@@ -21,6 +21,14 @@ export const SYSTEM_CATEGORIES = Object.freeze([
     publishPolicy: 'security_scan_required',
     sortOrder: 20,
   },
+  {
+    code: 'health',
+    name: '健康档案区',
+    visibilityPolicy: 'private',
+    aiAccessPolicy: 'explicit_asset_grant',
+    publishPolicy: 'password_required',
+    sortOrder: 30,
+  },
   {
     code: 'draft',
     name: '页面草稿',
@@ -181,7 +189,7 @@ export function createMindSpaceService(pool, options = {}) {
               c.ai_access_policy, c.publish_policy, c.is_system, c.sort_order,
               CASE
                 WHEN c.category_code = 'draft' THEN COALESCE(pc.item_count, 0)
-                WHEN c.category_code IN ('oa', 'public') THEN COALESCE(pc.item_count, 0) + COALESCE(ac.item_count, 0)
+                WHEN c.category_code IN ('oa', 'public', 'health') THEN COALESCE(pc.item_count, 0) + COALESCE(ac.item_count, 0)
                 ELSE COALESCE(ac.item_count, 0)
               END AS item_count
        FROM h5_space_categories c