Release v1.38.24

[MBombeck]

Patch release. Everything since v1.38.23 that is on main; #892 stays out until an iOS build decodes its new source value.

• [Bug] Insights homepage fails to load if any/all AI features are disabled #975 Insights loaded as one error page when the assistant was switched off, and the same switch refused watch ECG uploads. Six deterministic reads no longer gate on it; the mood trend follows its module (merged via fix(insights): keep the overview reads open with the assistant switched off #982).
• [Feature] Reconsider hard-pinning PostgreSQL minor versions in Docker Compose #987 The bundled PostgreSQL moves to 16.15 and is now watched by the compose ecosystem, with majors ignored (chore(deps): move the database pin to 16.15 and watch it #988, chore(deps): keep PostgreSQL majors out of the update stream #995).
• Alert 88 The Trivy installer is fetched from a commit and verified against its hash before it runs (ci(security): pin and verify the Trivy installer #996); the alert is fixed.
• Dependency updates: nodemailer 10 (its own types now, the separate package dropped), sax, sonner, jose, napi canvas, react-virtual, types/node.

Local gate runs alongside CI.