docs: 修正测试策略 spec 的事实性错误

修正 spec review 发现的问题:
- C-1: TestDb 实际是本地 PostgreSQL 隔离，非 Testcontainers
- C-2: E2E 已有 4 spec/10 测试，非零测试
- 补充 6 个遗漏的 service（alert/daily_monitoring/critical_value_threshold 等）
- 增加 Phase 0 基础设施搭建
- 修正 CI 配置（增加 PostgreSQL service、验证链）
- 补充 5 个遗漏风险项和回退策略
- 统一"全量 80%"目标的准确含义

crates/erp-health/src/handler/device_reading_handler.rs

@@ -0,0 +1,92 @@
+use axum::extract::{FromRef, Path, Query, State};
+use axum::response::IntoResponse;
+use axum::Extension;
+use serde::Deserialize;
+use utoipa::IntoParams;
+use uuid::Uuid;
+
+use erp_core::error::AppError;
+use erp_core::rbac::require_permission;
+use erp_core::types::{ApiResponse, PaginatedResponse, TenantContext};
+
+use crate::service::device_reading_service;
+use crate::state::HealthState;
+
+#[derive(Debug, Deserialize)]
+pub struct PatientPath {
+    pub patient_id: Uuid,
+}
+
+#[derive(Debug, Deserialize, IntoParams)]
+pub struct ReadingListQuery {
+    pub device_type: Option<String>,
+    pub hours: Option<i64>,
+    pub page: Option<u64>,
+    pub page_size: Option<u64>,
+}
+
+#[derive(Debug, Deserialize, IntoParams)]
+pub struct HourlyQuery {
+    pub device_type: String,
+    pub days: Option<i64>,
+    pub page: Option<u64>,
+    pub page_size: Option<u64>,
+}
+
+pub async fn batch_create<S>(
+    State(state): State<HealthState>,
+    Extension(ctx): Extension<TenantContext>,
+    Path(path): Path<PatientPath>,
+    axum::Json(body): axum::Json<device_reading_service::BatchReadingRequest>,
+) -> Result<impl IntoResponse, AppError>
+where
+    HealthState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "health.device-readings.manage")?;
+    let result = device_reading_service::batch_create_readings(
+        &state, ctx.tenant_id, path.patient_id, body,
+    ).await?;
+    Ok(axum::Json(ApiResponse::ok(result)))
+}
+
+pub async fn list_readings<S>(
+    State(state): State<HealthState>,
+    Extension(ctx): Extension<TenantContext>,
+    Path(path): Path<PatientPath>,
+    Query(query): Query<ReadingListQuery>,
+) -> Result<impl IntoResponse, AppError>
+where
+    HealthState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "health.device-readings.list")?;
+    let page = query.page.unwrap_or(1);
+    let page_size = query.page_size.unwrap_or(20);
+    let result = device_reading_service::query_device_readings(
+        &state, ctx.tenant_id, path.patient_id,
+        query.device_type.as_deref(), query.hours, page, page_size,
+    ).await?;
+    Ok(axum::Json(ApiResponse::ok(result)))
+}
+
+pub async fn list_hourly<S>(
+    State(state): State<HealthState>,
+    Extension(ctx): Extension<TenantContext>,
+    Path(path): Path<PatientPath>,
+    Query(query): Query<HourlyQuery>,
+) -> Result<impl IntoResponse, AppError>
+where
+    HealthState: FromRef<S>,
+    S: Clone + Send + Sync + 'static,
+{
+    require_permission(&ctx, "health.device-readings.list")?;
+    let page = query.page.unwrap_or(1);
+    let page_size = query.page_size.unwrap_or(20);
+    let days = query.days.unwrap_or(7);
+    let result = device_reading_service::query_hourly_readings(
+        &state, ctx.tenant_id, path.patient_id,
+        &query.device_type, days, page, page_size,
+    ).await?;
+    Ok(axum::Json(ApiResponse::ok(result)))
+}