feat(fitbit): add PKCE code_verifier column to the OAuth-state ledger

The classic Fitbit Web API authorises with PKCE (Authorization Code + S256),
so the connect route mints a code_verifier and the callback presents it on the
token exchange. Carry it on the short-lived FitbitOAuthState row.

Additive + nullable (migration 0191): a legacy in-flight row carries no
verifier, so the change is reversible and rerun-safe with no data loss.

prisma/migrations/0191_v1200_fitbit_pkce_verifier/migration.sql

@@ -0,0 +1,8 @@
+-- v1.20.0 — classic Fitbit Web API (api.fitbit.com) authorises with PKCE
+-- (Authorization Code + S256). Carry the per-handshake `code_verifier` from the
+-- connect route to the callback on the short-lived OAuth-state ledger row.
+--
+-- Additive + nullable: a legacy in-flight row (or any non-PKCE path) simply
+-- carries no verifier, so this is reversible and rerun-safe with no data loss.
+-- `IF NOT EXISTS` guards a prod rerun.
+ALTER TABLE "fitbit_oauth_states" ADD COLUMN IF NOT EXISTS "code_verifier" TEXT;

prisma/schema.prisma

@@ -2644,11 +2644,20 @@ model FitbitConnection {
 
 /// v1.12.0 — short-lived `(nonce → userId)` ledger backing the Fitbit OAuth
 /// state check, identical in shape + lifecycle to `WhoopOAuthState`.
+///
+/// v1.20.0 — the classic Fitbit Web API (`api.fitbit.com`) authorises with PKCE
+/// (Authorization Code + S256), so the connect route mints a `code_verifier`
+/// alongside the nonce and stashes it here; the callback reads it back to present
+/// on the token exchange. Nullable + additive: a legacy row (or a non-PKCE path)
+/// simply carries no verifier.
 model FitbitOAuthState {
-  nonce     String   @id
-  userId    String   @map("user_id")
-  createdAt DateTime @default(now()) @map("created_at")
-  expiresAt DateTime @map("expires_at")
+  nonce        String   @id
+  userId       String   @map("user_id")
+  /// PKCE code_verifier carried from connect to callback (v1.20.0). Null when no
+  /// PKCE handshake is in flight (legacy rows).
+  codeVerifier String?  @map("code_verifier")
+  createdAt    DateTime @default(now()) @map("created_at")
+  expiresAt    DateTime @map("expires_at")
 
   user User @relation(fields: [userId], references: [id], onDelete: Cascade)