fix(whoop): trim pasted credentials and honour the derived redirect fallback

A trailing space from the portal's copy button reached WHOOP verbatim
and answered as an unknown client; the credential schema trims both
fields. The redirect override fell through nullish coalescing, so the
empty string the compose whitelist materialises for an unset var was
sent as the literal redirect target — empty now derives the callback
from the app URL.

src/lib/validations/whoop.ts

@@ -7,8 +7,10 @@ import { z } from "zod/v4";
  * multi-operator product). Stored encrypted on `User`.
  */
 export const whoopCredentialsSchema = z.object({
-  clientId: z.string().min(1).max(200),
-  clientSecret: z.string().min(1).max(200),
+  // Trimmed: a trailing space or newline from the portal's copy button
+  // reaches WHOOP verbatim and answers as "unknown client".
+  clientId: z.string().trim().min(1).max(200),
+  clientSecret: z.string().trim().min(1).max(200),
 });
 
 export type WhoopCredentialsInput = z.infer<typeof whoopCredentialsSchema>;

src/lib/whoop/client.ts

@@ -34,8 +34,10 @@ export interface WhoopCredentials {
 }
 
 function getRedirectUri(): string {
+  // `||`, not `??`: the compose whitelist materialises the var as an empty
+  // string when unset, which must still fall through to the derived URI.
   return (
-    process.env.WHOOP_REDIRECT_URI ??
+    process.env.WHOOP_REDIRECT_URI ||
     `${process.env.NEXT_PUBLIC_APP_URL}/api/whoop/callback`
   );
 }