feat: HL7/FHIR, e-prescribing & insurance claims integrations

Real, standards-compliant integration clients that the clinic points at
its own (sandbox or production) endpoints — no mock data.

backend:
- `integrations` table (per org+type) storing endpoint + encrypted
  credentials (reusing the AI-key crypto) + status; Drizzle migration
- services/integrations:
  - fhir.ts — FHIR R4 REST client (pull lab Observations → patient
    record), HL7 v2 ORU parsing, capability-statement connection test
  - eprescribe.ts — NCPDP SCRIPT NewRx message build + transmit
  - claims.ts — X12 837P claim generation + 835 remittance parsing
- `/api/integrations` route: config GET/PUT (owner/admin), connection
  test, and the FHIR sync / HL7 ingest / e-Rx send / claim submit actions,
  RBAC-gated (lab/patient, prescription, invoice)

frontend:
- lib/integrations.ts client
- Settings → Integrations tab to configure endpoints/credentials/enable
  + test each integration
- on-page actions, shown only when the integration is enabled:
  Lab page → FHIR "Sync results" card; prescription sheet → "Send to
  pharmacy"; invoice sheet → "Submit claim"

Production e-Rx/claims routing requires the clinic's own Surescripts /
clearinghouse credentials; the code transmits real messages once supplied.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/db/schema/index.ts

@@ -15,3 +15,4 @@ export * from "./ai.js";
 export * from "./ai-chat.js";
 export * from "./org-ai-policy.js";
 export * from "./attachments.js";
+export * from "./integrations.js";

backend/src/db/schema/integrations.ts

@@ -0,0 +1,40 @@
+import {
+  boolean,
+  pgTable,
+  primaryKey,
+  text,
+  timestamp,
+} from "drizzle-orm/pg-core";
+
+import { organization } from "./auth.js";
+
+// External healthcare-system integrations, configured per clinic. One row per
+// (organization, type):
+//   fhir       → HL7/FHIR lab-system connection (lab results in/out)
+//   eprescribe → NCPDP SCRIPT e-prescribing to pharmacies
+//   claims     → X12 837/835 insurance claims clearinghouse
+// `credentials` is an encrypted JSON blob (API key / bearer token / submitter
+// IDs — shape depends on the type); `endpoint` is the base URL the clinic
+// points the integration at (a vendor sandbox or production gateway).
+export const integrations = pgTable(
+  "integrations",
+  {
+    organizationId: text("organization_id")
+      .notNull()
+      .references(() => organization.id, { onDelete: "cascade" }),
+    type: text("type").notNull(),
+    endpoint: text("endpoint").notNull().default(""),
+    credentials: text("credentials"),
+    enabled: boolean("enabled").notNull().default(false),
+    // "unconfigured" | "connected" | "error" — last known connection state.
+    status: text("status").notNull().default("unconfigured"),
+    lastSyncAt: timestamp("last_sync_at"),
+    updatedAt: timestamp("updated_at")
+      .defaultNow()
+      .$onUpdate(() => new Date())
+      .notNull(),
+  },
+  (table) => [
+    primaryKey({ columns: [table.organizationId, table.type] }),
+  ],
+);