chore(release): v1.38.3 — delete from the phone, name every source

[MBombeck]

Release v1.38.3, both fixes merged since v1.38.2.

• An account with two-factor can be deleted from the phone (fix(auth): let the app delete an account that has a second factor #888). Apple requires in-app account deletion, and ours refused every native client whose account had a factor enrolled, because the fresh-factor proof lived on the session row. The app now re-proves through the step-up ceremony it already uses for factor management and sends the elevation in a header. The web path is untouched and a token on its own still gets nowhere.
• Every measurement source is called by its name (fix(i18n): name every measurement source instead of showing its enum #889). Seven of fourteen sources had no display label, in two catalogues, plus one in the intake history, so a reader saw GOOGLE_HEALTH where others said Withings. All seven languages are complete, and a test derives the members from the schema enums so the next provider cannot ship nameless.

Correction carried in this release: the account-deletion entry had landed under the v1.38.2 heading in the changelog, but it was merged after that tag and is not in that image. It moves to this section.

Gate on this branch: typecheck, lint (three known warnings), format:check, openapi:check, full unit suite (1935 files), pnpm build. All clean.