fix(api): provide pseudonymous patients access to doctor care

app/api/patient_web.py

@@ -7,9 +7,9 @@ exactly like the web console, and consent, onboarding, scales and check-ins come
 Two ways in:
 - **ЕМИАС** (demo): the doctor's one-time connect code via `EmiasMock`, or a synthetic demo persona. The
   patient is linked to the attending doctor, who sees the data on the dashboard.
-- **Anonymous**: a random pseudonymous token and nothing else — no identity record, no doctor. The engine
-  supports tokens without an identity record (consent is kept in the dialog state), so no personal data is
-  stored at all. Crisis safety still works: the fixed crisis script does not depend on the doctor.
+- **Anonymous**: a random pseudonymous token, no identity record, and access to the prototype care team.
+  Clinical answers are stored on the server and visible to the assigned doctor under a pseudonym.
+  Consent is kept in the dialog state. Existing doctor-less profiles require explicit care opt-in.
 
 The token returned here is the session credential of the prototype. Production needs short-lived sessions
 issued by the server instead of handing out the pseudonymous token itself.
@@ -36,11 +36,13 @@ from app.core.interpretation import texts as results_texts
 from app.core.meds_reference import find_drug, indication_for, load_reference
 from app.core.safety import CrisisResource, crisis_reply
 from app.db import repo
+from app.db.audit import audit
 from app.db.clinical import DailyCheckin, Dose, Prescription
 from app.db.identity import TOKEN_LEN
 from app.db.intake import QuestionnaireRecord
 from app.db.session import get_clinical_session
 from app.integrations.emias_mock import CODE_MAX_LEN, EmiasMock
+from app.services import anonymous_care
 
 log = logging.getLogger(__name__)
 
@@ -153,19 +155,40 @@ async def auth_emias_demo(body: EmiasDemoIn) -> AuthOut:
 
 @router.post("/auth/anonymous", response_model=AuthOut)
 async def auth_anonymous(body: AnonymousIn | None = None) -> AuthOut:
-    """Anonymous sign-in: a fresh random token; no identity record, no doctor.
+    """Anonymous sign-in: a fresh random token; care without an identity record.
 
-    The clinical side gets a doctor-less pseudonymous profile (the dialog API serves known profiles only). It holds
-    no personal data — only the module of the chosen `focus`; the stage 1 screening then sets the modules itself.
+    The clinical side gets a pseudonymous profile assigned to the prototype care team. It holds
+    no identity fields. Legacy clients may supply `focus`; the common stage 1 screening sets modules itself.
     """
     token = secrets.token_hex(TOKEN_LEN // 2)
     focus = body.focus if body is not None else None
     async with get_clinical_session() as s:
-        await repo.upsert_profile(s, token=token, doctor_id="", modules=[_FOCUS_MODULE[focus]] if focus else [])
+        await repo.upsert_profile(
+            s, token=token, doctor_id=anonymous_care.doctor_id(), modules=[_FOCUS_MODULE[focus]] if focus else []
+        )
     log.info("web auth: anonymous tok=%s", token[:6])
     return AuthOut(token=token, mode="anonymous")
 
 
+@router.get("/patient/capabilities")
+async def patient_capabilities() -> dict[str, bool]:
+    """Expose availability without leaking clinical policy or server configuration."""
+    return {"primary_screening": intake_enabled()}
+
+
+@router.post("/me/{token}/doctor/connect")
+async def connect_anonymous_doctor(token: str) -> dict[str, bool]:
+    """Explicit opt-in for old doctor-less profiles; never reassign an existing doctor."""
+    async with get_clinical_session() as s:
+        profile = await repo.get_profile(s, token)
+        if profile is None:
+            raise HTTPException(404, "patient not found")
+        if not profile.doctor_id:
+            profile.doctor_id = anonymous_care.doctor_id()
+            await audit(s, actor=token, action="anonymous_care_opt_in", token=token, ts=clock.now())
+    return {"has_doctor": True}
+
+
 class DoseItem(BaseModel):
     id: int
     drug: str