fix(cycle): let a logged value be taken back

[MOHITKOURAV01]

Closes #549.

Log a day, then try to take one of the values back. You can't — and the
web app tells you it worked.

Both write routes stripped every None before touching Firestore:

fields = {k: v for k, v in log.model_dump().items() if ... v is not None}

model_dump() cannot tell an omitted field from one explicitly sent as
null — both are None — so the filter that implements "merge, don't
clobber what wasn't sent" also implements "you may never send a
clearing". PUT /cycle/{log_id} with {"notes": null} went further and
answered "No fields provided for update": a field was provided, the
handler discarded it, and then reported the discarding as the caller's
mistake.

On the web Cycle screen this is visible. The chips are toggles —
toggleSingle deselects to null and the chip un-highlights — but
save() built its payload with a truthiness check per field, so the
cleared value never left the browser. The page said "✓ Saved to your
account", reloaded the month, re-seeded the draft from the unchanged
server copy, and lit the chip back up.

It matters because this is a health record and the things a user most
wants to take back are the ones she can't: a wrong flow intensity feeds
compute_cycle_stats, predict() and the SMS summary; a wrong sleep
value skews the avgSleepHours on the provider's patient card; and a
note naming a partner or a clinic is in the provider view, the PDF report
and /privacy/export.

What changed

_submitted_fields reads model_fields_set instead of filtering on
value, so the two cases separate cleanly: a key that is absent is left
alone, a key that is present and null is a request to remove it. The
Home screen's quick-log tiles still merge — sending flow_intensity
alone does not disturb the mood logged an hour earlier.

CycleService._prepare_write turns a None into DELETE_FIELD. The
one asymmetry is for_new_document: Firestore's set refuses the
sentinel, correctly — there is nothing to delete in a document being
created — so a clearing of a never-written field is dropped and the
field ends up absent either way.

The 400 keeps its meaning and becomes true. It now fires only when
the body genuinely carried nothing.

The Cycle screen sends the fields it renders, null where cleared,
and Save is gated on the draft differing from the stored log rather than
on anything being selected. That second half matters as much as the
first: clearing the last chip left nothing selected, so the button went
disabled and the correction could not be sent at all.

notes and end_date are deliberately not sent from that screen. Both
exist on a log and neither has a control there, so including them would
let a screen that cannot show a note delete one.

The Firestore mock acts on the sentinel rather than storing it, and
rejects it in set() as real Firestore does. The rule for that mock is
that it may be narrower than Firestore but never looser, and silently
storing a write instruction as a value is looser — it would have made
every test below pass while a real deployment served clients an
unparseable object.

Tests

backend/tests/test_cycle_log_clearing.py — 18 cases, reading the stored
document back through GET /{user_id}/history rather than inspecting the
mock's store, because "is the field gone?" is only meaningfully answered
by what a subsequent read returns.

The merge behaviour is asserted alongside the clearing in almost every
case. The risk in this change is not that clearing stops working — it is
that clearing starts happening to fields nobody mentioned, which would
silently destroy data on every quick-log tap.

web/src/pages/CyclePage.test.tsx — 8 new cases asserting on the
payload, not on what the page renders afterwards. What it renders after
a save is whatever the mocked reload returns, so a render assertion would
pass against the broken version too. The request is where the bug was.

Backend 1151 passed. Web 592 passed, tsc -b and oxlint clean.

[vercel]

@MOHITKOURAV01 is attempting to deploy a commit to the ishita2740's projects Team on Vercel.

A member of the Team first needs to authorize it.