feat: idempotent writeWorkoutData + accurate authorization helpers

[magic-fit]

Motivation

Apps that sync workouts from another device or backend into HealthKit /
Health Connect need reliable dedup across reinstalls, OS migrations, and
repeated network retries. Both platforms expose first-class upsert
mechanisms for exactly this — HKMetadataKeySyncIdentifier on iOS and
Metadata.clientRecordId on Health Connect — but health currently
doesn't surface either, forcing consumers to either tolerate duplicate
records or ship their own native code on top of the plugin.

This PR extends writeWorkoutData to pass these platform-native upsert
keys through, along with a couple of adjacent gaps (zone offsets,
active-vs-total calories, accurate iOS authorization state, and Health
Connect install detection). Every addition is backward-compatible — no-
new-params callers get byte-for-byte identical behaviour.

What's new

writeWorkoutData parameters (all optional)

Param	Platform	Role
syncIdentifier + syncVersion	iOS	HKMetadataKeySyncIdentifier + HKMetadataKeySyncVersion — HealthKit's documented upsert mechanism
clientRecordId + clientRecordVersion	Android	Metadata.clientRecordId / clientRecordVersion — HC's documented upsert mechanism
startZoneOffset / endZoneOffset	Android	Attached to ExerciseSessionRecord and linked records; preserves local-day aggregation across timezone changes
deviceType	Android	Device(type = ...) for auto/active Metadata factories
iosExtraMetadata	iOS	Arbitrary keys merged into the HKWorkout metadata dict
useActiveEnergy	Android	When true, emits ActiveCaloriesBurnedRecord instead of TotalCaloriesBurnedRecord (excludes BMR, which can over-report the workout contribution)

New methods

• accurateAuthorizationStatus({required types}) — returns a
  three-valued HealthPermissionStatus (notDetermined / denied /
  granted). iOS reads HKHealthStore.authorizationStatus(for:) per
  type and aggregates worst-case. Android delegates to
  getGrantedPermissions().containsAll(...). Fills the gap left by
  hasPermissions, which deliberately returns null on iOS READ
  intent.

• isHealthConnectPackageInstalled() — returns whether the
  com.google.android.apps.healthdata package is installed. Splits
  the ambiguity of getHealthConnectSdkStatus's
  sdkUnavailableProviderUpdateRequired state so callers can route
  the user to an install vs update CTA.

Design notes

iOS metadata merge order

iosExtraMetadata is merged before the sync-identifier keys, so a
caller cannot accidentally overwrite HKMetadataKeySyncIdentifier /
HKMetadataKeySyncVersion through the extras map. When no new params
are supplied, the HKWorkout metadata dict stays nil.

Android linked-record IDs

ExerciseSessionRecord, linked DistanceRecord, and linked calorie
record each get a distinct clientRecordId:

• session: <clientRecordId>
• distance: <clientRecordId>:distance
• calories: <clientRecordId>:calories

This prevents HC from rejecting the insert as a duplicate-upsert batch.

Zone offset safety

ZoneOffset.ofTotalSeconds throws DateTimeException for values
outside UTC±18h; a new safeZoneOffset() helper catches and logs a
warning rather than surfacing an uncaught platform error.

Validation

Both id/version pairs are checked both directions at the Dart layer:
providing only one half throws ArgumentError — catches programmer
error before the method channel call.

device_info_plus constraint

Also includes a one-line pubspec change relaxing the device_info_plus
dependency from ^12.1.0 to >=12.1.0 <14.0.0. The plugin only reads
androidInfo.id and iosInfo.identifierForVendor — both fields are
unchanged across v12 and v13. Blocking consumers on v13 had no
source-level reason, and the full test suite is green against both
majors.

Known limitation

Rewriting a workout with a higher clientRecordVersion that omits
totalDistance or totalEnergyBurned leaves the old linked record in
place (the session's upsert succeeds but the linked records are never
revisited). Deliberately out of scope for this PR — all the use cases
we've validated rewrite with all three fields on every call. Happy to
add a separate deleteLinkedRecordsOnRewrite opt-in in a follow-up if
you'd prefer to land the fix here.

Tests

• 25 new Dart unit tests added via the existing
  HealthTestContext harness:
  • 16 in test/unit/health_plugin_writes_test.dart — every new
    writeWorkoutData param, validation rules, backward-compat
  • 9 in test/unit/health_plugin_permissions_test.dart — wire
    string parsing, empty-types guard, null-response fail-closed
• 1 incidental test fix in test/support/stub_device_info.dart:
  adds isiOSAppOnVision (required by device_info_plus 12.1+) and
  drops the dead serialNumber key (removed in v13). Without the
  isiOSAppOnVision addition the existing suite was already red on
  every setUp() that calls Health().

All tests pass: 77/77 green on flutter test.

Example app demo

The example app ships a Test Idempotency button that exercises the
full upsert flow end-to-end on a connected device. Tapping it writes
the same workout twice with identical sync/client ids, then queries
back and reports the count — should always be 1 regardless of tap
count. Day-bucketed session id so tomorrow's tap produces a fresh
record.

Verified on a Pixel 7 running Android 16 (Health Connect provider
installed): 2 button presses × 2 writes each = 4 total writes → 1
record in Health Connect. iOS verification pending a paired-device
test, happy to pair with a reviewer to run it if helpful.

To reproduce:

cd example
flutter run -d <device-id>
# In the app: Authorize → tap "Test Idempotency" 2–3 times
# → read the on-screen result
# → open Apple Health / Health Connect to visually confirm

Commits

1. 76faee9 — test: add isiOSAppOnVision to StubDeviceInfoPlugin
2. cd2ab57 — feat(writeWorkoutData): idempotent-write metadata, zone offsets, active-energy opt-in
3. ddbdafd — feat: accurateAuthorizationStatus + isHealthConnectPackageInstalled
4. bd5ca78 — docs(example): idempotency demo button
5. 76718f5 — chore: allow device_info_plus 13.x