Add body measurement reads to federation

[kgenerozov]

Summary

• Adds owner-scoped body measurement reads to the TraceApps federation API.
• Adds the narrow read:body-measurements capability.
• Reuses the existing body-composition core.
• Preserves exact source provenance.

Contract

• Default 90-day range.
• Optional start, end, and source.
• Exact source filtering.
• No merge, averaging, or filling between sources.
• Additive v1 response.

Compatibility

• Existing POST body-measurement flow unchanged.
• Existing federation scopes continue working.
• Public API flags are not involved.
• No database migration.

Testing

• node --test scripts/federation-body-measurements.test.js scripts/mcp-body-composition.test.js scripts/mcp-core-extraction.test.js scripts/mcp-wiring.test.js scripts/public-api-v1-wiring.test.js — 5/5 PASS.
• Full npm test — 656 passed, 3 skipped, 0 failed in normal host validation.
• npm run build — PASS.
• npm run i18n:check — PASS.
• git diff --check — PASS.
• The restricted sandbox separately reproduces two pre-existing environment-only failures: fold-surfaces (/bin/sh EPERM) and webhook-delivery (listen EPERM).

Live validation

Sanitized end-to-end validation confirmed that a wrong-owner federation credential cannot read another user's body data, while the correct owner can read the owner's observations through the consumer flow. No usernames, measurements, PAT IDs, tokens, internal URLs, or container details are included here.