fix(polar): clear each leg on its own success, read a lone 403 as refused

The workouts leg recorded its failures under its own leg but left the
success to the vitals leg. A leg-scoped success clears only its own
leg, so one workouts failure stayed on the row for good and kept the
connection in error however healthy the exercises read became. Each
leg now records its own success.

AccessLink documents its 403 as missing consent for that data. A 403
on one collection while a sibling succeeded with the same token was
classified reauth_required and put a working connection behind a
reconnect prompt no reconnect clears. Like Oura's scope refusals, such
a collection (or the exercises read, once the vitals leg proved the
token) is now noted on the wide event and not counted as a failure. A
403 on every collection, or any 401, stays one.

src/app/api/polar/sync/__tests__/route.test.ts

@@ -67,13 +67,21 @@ beforeEach(() => {
   vi.clearAllMocks();
   vi.mocked(checkRateLimit).mockResolvedValue({ allowed: true } as never);
   vi.mocked(requireAuth).mockResolvedValue({ user: { id: "u1" } } as never);
-  syncUserPolarMock.mockResolvedValue({ imported: 0, failed: false });
+  syncUserPolarMock.mockResolvedValue({
+    imported: 0,
+    failed: false,
+    tokenProven: true,
+  });
   syncUserPolarWorkoutsMock.mockResolvedValue(0);
 });
 
 describe("POST /api/polar/sync", () => {
   it("runs both Polar legs and totals what they imported", async () => {
-    syncUserPolarMock.mockResolvedValue({ imported: 5, failed: false });
+    syncUserPolarMock.mockResolvedValue({
+      imported: 5,
+      failed: false,
+      tokenProven: true,
+    });
     syncUserPolarWorkoutsMock.mockResolvedValue(2);
 
     const response = await post(request());
@@ -84,7 +92,10 @@ describe("POST /api/polar/sync", () => {
       error: null,
     });
     expect(syncUserPolarMock).toHaveBeenCalledWith("u1");
-    expect(syncUserPolarWorkoutsMock).toHaveBeenCalledWith("u1");
+    // The vitals leg tells the workouts leg the token just worked.
+    expect(syncUserPolarWorkoutsMock).toHaveBeenCalledWith("u1", {
+      tokenProven: true,
+    });
   });
 
   it("does not call a run whose vitals collections all failed a success", async () => {