refactor: 移除 EventDictionary 的 health_record_action（ADR-013）

- health_record_action 从白名单直接移除（客户端零引用，废弃零成本）
- M2 事件按字典 v2（具体事件名，iteration-2/06）随第二波接口纵切落地；
  不复活通用 actionType 设计（多套指标共享分母污染）
- v1 auth 漏斗事件 + page_viewed（遗留 §2）为当前完整白名单
- 新增 EventDictionaryTest：锁定移除后白名单边界，回归防护

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

patbond-user/src/main/java/com/patbond/patbond/user/analytics/EventDictionary.java

@@ -5,8 +5,9 @@ import java.util.Set;
 import java.util.regex.Pattern;
 
 /**
- * Event dictionary v1 (report 13 §4, auth funnel) plus the two additions this
- * ticket requires (page_viewed / health_record_action — flagged in report 19).
+ * Event dictionary v1 (report 13 §4, auth funnel) plus page_viewed (report 19).
+ * ADR-013: health_record_action removed (client zero-reference, v2 events will
+ * be specific per action when M2 second wave lands).
  * Unknown event names reject the whole event; props outside the per-event
  * whitelist are stripped (kept event, counted warning); props whose KEY
  * matches the privacy red-line pattern (report 13 §5.2.4) reject the event.
@@ -34,9 +35,8 @@ public final class EventDictionary {
             Map.entry("auth_session_restore_succeeded", Set.of("durationMs", "usedRefresh")),
             Map.entry("auth_session_restore_failed",
                     Set.of("failureReason", "errorCode", "httpStatus")),
-            // Ticket additions beyond dictionary v1 (see report 19):
-            Map.entry("page_viewed", Set.of("pageName", "referrer")),
-            Map.entry("health_record_action", Set.of("recordType", "actionType"))
+            // Report 19 遗留项 §2:
+            Map.entry("page_viewed", Set.of("pageName", "referrer"))
     );
 
     public static boolean isKnownEvent(String eventName) {

patbond-user/src/test/java/com/patbond/patbond/user/analytics/EventDictionaryTest.java

@@ -0,0 +1,31 @@
+package com.patbond.patbond.user.analytics;
+
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Locks the dictionary's whitelist boundaries: ADR-013 removed the
+ * health_record_action placeholder (client zero-reference); v1 auth funnel
+ * events plus page_viewed remain the complete set until dictionary v2 lands
+ * with M2's second wave.
+ */
+class EventDictionaryTest {
+
+    @Test
+    void healthRecordActionIsRemovedPerAdr013() {
+        assertThat(EventDictionary.isKnownEvent("health_record_action")).isFalse();
+    }
+
+    @Test
+    void v1EventsAndPageViewedRemainKnown() {
+        assertThat(EventDictionary.isKnownEvent("auth_register_started")).isTrue();
+        assertThat(EventDictionary.isKnownEvent("auth_login_succeeded")).isTrue();
+        assertThat(EventDictionary.isKnownEvent("page_viewed")).isTrue();
+    }
+
+    @Test
+    void unknownEventHasEmptyAllowedProps() {
+        assertThat(EventDictionary.allowedProps("health_record_action")).isEmpty();
+    }
+}