feat(handler): server 模式健康档案查询端点（T-208）

- GET /api/health-record/find 按 idCard/phrid/personName/empiId 查询
- 回写平台完整响应（Result.Raw），未建模字段不丢失
- 抽 buildOSIClient 共用构造，verify 与 server 复用
- 默认仅绑 127.0.0.1（端点返回真实档案 PII，避免暴露局域网）

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

handler/health_record.go

@@ -0,0 +1,58 @@
+package handler
+
+import (
+	"encoding/json"
+	"net/http"
+
+	"chis_osi/osi"
+)
+
+// HealthRecordHandler 暴露健康档案查询的 HTTP 入口。
+type HealthRecordHandler struct {
+	client *osi.Client
+}
+
+func NewHealthRecordHandler(client *osi.Client) *HealthRecordHandler {
+	return &HealthRecordHandler{client: client}
+}
+
+// Find 处理 GET /api/health-record/find?idCard=..|phrid=..|personName=..|empiId=..
+// 直接回写平台完整响应（{code,message,data:[...]}），不做字段裁剪——查询响应可能含
+// Go 结构体未建模的字段，回写原始 JSON 才能看到完整档案内容。
+func (h *HealthRecordHandler) Find(w http.ResponseWriter, r *http.Request) {
+	if r.Method != http.MethodGet {
+		writeJSONError(w, http.StatusMethodNotAllowed, "only GET is supported")
+		return
+	}
+
+	q := r.URL.Query()
+	query := osi.FindHealthRecordQuery{
+		IDCard:     q.Get("idCard"),
+		PHRID:      q.Get("phrid"),
+		PersonName: q.Get("personName"),
+		EMPIID:     q.Get("empiId"),
+	}
+	if query.IDCard == "" && query.PHRID == "" && query.PersonName == "" && query.EMPIID == "" {
+		writeJSONError(w, http.StatusBadRequest, "provide one of: idCard, phrid, personName, empiId")
+		return
+	}
+
+	_, result, err := h.client.FindHealthRecord(r.Context(), query)
+	// 拿到平台响应就原样回写（成功或业务错误都含 code/message），便于查看完整内容。
+	if len(result.Raw) > 0 {
+		w.Header().Set("Content-Type", "application/json; charset=utf-8")
+		_, _ = w.Write(result.Raw)
+		return
+	}
+	if err != nil {
+		writeJSONError(w, http.StatusBadGateway, err.Error())
+		return
+	}
+	writeJSONError(w, http.StatusBadGateway, "empty response from OSI")
+}
+
+func writeJSONError(w http.ResponseWriter, status int, msg string) {
+	w.Header().Set("Content-Type", "application/json; charset=utf-8")
+	w.WriteHeader(status)
+	_ = json.NewEncoder(w).Encode(map[string]string{"error": msg})
+}