fix: refine hysteresis recalculation with MA pre-smoothing and lower thresholds

- dem.py: pre-smooth elevation with 30s moving average before hysteresis
  in recalculate_elevation_hysteresis(); thresholds drop from 5m/10m to
  1m (barometric) / 3m (GPS) — accurate after noise is smoothed out
- dem.py: widen DEM median-filter window 45s → 60s
- dem.py: rename response key source → altitude_source for consistency
- writer.py: write altitude_source into detail JSON at extract time
- tests/test_dem.py: 21 unit tests for pure functions and file-level hysteresis
- tests/test_edit_server.py: 11 TestClient API tests for both recalculate endpoints
- add httpx as dev dependency (required by FastAPI TestClient)

CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## [Unreleased] — 2026-04-22
+
+### Improvement — DEM & hysteresis algorithm refinements
+
+**Hysteresis-only recalculation** (`recalculate_elevation_hysteresis`) reworked:
+
+- Pre-smooths the elevation series with a **30 s centred moving average** (O(n)
+  cumsum implementation) before accumulation. Pre-smoothing suppresses barometric
+  quantization steps and GPS jitter without discarding real terrain.
+- Hysteresis thresholds reduced to **1 m (barometric)** / **3 m (GPS/unknown)**
+  — safe after pre-smoothing, and accurate enough to capture genuine small climbs
+  that the previous 5 m / 10 m thresholds were swallowing.
+- Response key renamed `source` → `altitude_source` for consistency with the
+  detail JSON field.
+
+**DEM recalculation** median-filter window widened from 45 s → **60 s** to more
+reliably absorb the occasional larger SRTM tile-boundary step.
+
+`altitude_source` is now written into the activity detail JSON at extract time
+(`writer.py`), making the hysteresis endpoint source-aware for all newly uploaded
+activities.
+
+### Tests
+
+- **`tests/test_dem.py`** (new) — 21 tests covering `_moving_average`,
+  `_median_filter`, `_hysteresis_gain_loss`, and `recalculate_elevation_hysteresis`
+  at the file level (no network, no extract pipeline)
+- **`tests/test_edit_server.py`** (new) — 11 `TestClient` API tests for both
+  `/recalculate-elevation/hysteresis` and `/recalculate-elevation/dem` endpoints,
+  covering happy path, error codes (404/422/503), path-traversal rejection, and
+  on-disk JSON patching
+- `httpx` added as a dev dependency (required by FastAPI `TestClient`)
+
+---
+
 ## [Unreleased] — 2026-04-20
 
 ### Improvement — Elevation gain accuracy (hysteresis accumulation)