Merged, date-sorted feed of every record kind for a child.

Authentication: JWT required. Family members see all family records; a non-family caller sees only the documents and drafts they wrote (the Documents tab's gate). For documents the gate enforces it, since RLS admits clinicians. For drafts RLS agrees since #11702's migration, and the gate keeps the api right in any environment that migration hasn't reached.

Finalised clinic reports join the feed only when asked (include=report, or kind=report), which only appweb sends: without it the response is exactly what installed mobile builds already read (tests/api/records/test_report_opt_in.py pins it byte for byte).