[kgenerozov]

Summary

• Adds optional NutriTrace → LiftTrace body measurement synchronization.
• Imports weight and body fat only.
• Preserves manual LiftTrace body measurements.
• Updates LiftTrace's current weight from the synchronized measurement when applicable.

Behavior

• Off by default.
• Exact source selection; no cross-source mixing.
• Body provenance is bound to the verified canonical NutriTrace instance URL + NutriTrace user ID.
• Token is not identity.
• Token rotation is allowed for the same instance/user.
• Connection/source provenance mismatch blocks body sync.
• Body-read capability is optional.
• Workout federation remains independent from body provenance.
• Immediate sync when body sync is enabled.
• Startup/foreground opportunistic auto-sync with approximately 6-hour successful-sync throttle.
• Manual Sync bypasses that throttle.
• Repeat imports are idempotent.
• Critical federation settings use immediate awaited persistence.
• Pending debounced writes for those keys are cancelled.
• Writes for the same key are serialized.
• Connection transition persists federation OFF first, saves connection/body state, then enables federation last.
• Failed transitions roll back safely.

Compatibility

• Canonical field is bodyFat.
• Legacy body_fat remains readable.
• No historical migration.
• No database migration.
• No polling daemon.
• AIHealth unchanged.
• Companion NutriTrace federation read PR: Add body measurement reads to federation nutritrace#242.

Testing

Validated on rebased HEAD
1d23e1a6884b0d5e310de7fff178017beee06cbf
on upstream dev d7d421d9445750518305e134eece69b3e45a19f5:

• focused federation/body-sync/persistence gate: 7/7 files PASS
• npm test: 725/725 PASS
• npm run build: PASS
• npm run i18n:check: PASS
• git diff --check: PASS
• changed-JS node --check: 14/14 PASS

Live validation

• end-to-end federation body sync: PASS
• exact-source normalization: PASS
• no duplicate dates: PASS
• identical repeat sync produced zero writes: PASS
• auto-sync OFF persistence: PASS
• enabling auto-sync triggered an immediate sync: PASS
• foreground activity inside throttle produced no duplicate writes: PASS
• manual sync bypassed throttle: PASS
• canonical/legacy body-stat invariants: PASS
• federation OFF remained OFF after reopen: PASS
• federation ON remained ON after enabling it and immediately closing/reopening: PASS
• persisted state retained federation enabled, verified connection, and connection identity
• manual Body Measurements → Sync now on 2026-10-05: PASS
• correctly prefixed /lifttrace/api/nt/body-measurements returned 200 JSON
• UI reported that body measurements were up to date
• today's expected body measurement date was present
• body rows increased from 31 to 32 because today's date was new
• unique body dates remained unique
• alias duplicate count remained 0
• source remained health_connect
• body source and connection provenance remained unchanged

The previous subpath/PWA failure was resolved by rebasing onto upstream dev containing merged LiftTrace #129, Fix BASE_URL in controlled PWA shell. Its synchronous base-path bootstrap now runs before the application modules load, so the live body-sync request reaches the LiftTrace backend under the configured subpath.