[BackStacked]

This is the storage half of handoff list B1. The QR on a report or a bill opens a read-only page with that one booking's bill and released reports. The api owns the logic (tokens, expiry, rate limits, what is shown); this PR only stores the links.

What changes

• PatientLink type and a patientLinks repository on MongoDB and PostgreSQL, in the patient_links table / collection.
• Fields: organisation, branch, booking, patient, tokenHash (unique), nonce, expiresAt, revokedAt / revokedBy, createdBy, lastViewedAt, viewCount.
• The token is never stored. Rows hold its SHA-256 for lookup and a nonce. The api re-derives the token as an HMAC of the nonce with its own secret, so it can reprint the same QR. The nonce is useless without that secret.
• Docs: docs/PATIENT-LINKS.md, AGENTS.md rule 12, llms-full. Version 2.2.0.

Checks

• npm run typecheck, npm run build.
• TEST_BACKENDS=pg npm test: 103 passed, including 3 new contract checks (look up by hash with expiry kept, the unique token hash, revoke with view count and list per booking).
• MongoDB binaries can't be downloaded in my container; CI runs both backends.

---

Generated by Claude Code