feat(withings): OAuth scope upgrade + reconnect banner

v1.4.25 W5d. The Withings Activity / Sleep endpoints sit behind the
`user.activity` OAuth scope which v1.4.24-and-earlier connections
never requested. This commit ships the scope plumbing + reconnect
surface so existing users can opt in to step / active energy /
distance / floors-climbed ingest with a single click.

  - Schema: `WithingsConnection.scope` nullable column. NULL =
    legacy connection that's never re-authed since v1.4.25.
  - Migration 0050 — additive column add.
  - Client: `WITHINGS_OAUTH_SCOPE = "user.metrics,user.activity"`
    + `parseWithingsScope` / `hasActivityScope` helpers.
  - Callback: persists `scope: WITHINGS_OAUTH_SCOPE` on every
    successful exchange, so reconnecting upgrades the row.
  - Status route: exposes `scope` + `hasActivityScope` so the UI
    can render the reconnect banner conditionally.
  - Settings → Integrations: paint a reconnect banner when the
    user has an active connection AND `hasActivityScope === false`.
    Click → /api/withings/connect → standard OAuth flow.
  - i18n: EN + DE strings for the banner +
    `measurements.types.{fatFreeMass,fatMass,muscleMass,
    skinTemperature,pulseWaveVelocity,vascularAge,visceralFat}`.
  - 5 new unit tests covering the scope helpers.

Note: the Activity sync routine itself
(`POST /v2/measure?action=getactivity`) lands in v1.4.26. Shipping the
scope upgrade now means users only reconnect once instead of twice.

Cross-source dedup protection is already in place via the W5e
foundation (`pickCanonicalSourceRows`): once Activity sync lands AND
a user also has Apple Health passthrough (v1.5), the per-day picker
prevents double-counting cumulative metrics from two sources.

src/components/settings/integrations-section.tsx

@@ -230,6 +230,12 @@ function WithingsCard({
         lastSyncedAt?: string | null;
         connectedAt?: string;
         tokenExpired?: boolean;
+        // v1.4.25 W5d — reconnect banner conditional. `null` =
+        // legacy v1.4.24 connection without `user.activity`; the
+        // user needs to re-auth before steps / active energy /
+        // distance / floors ingest unlocks.
+        scope?: string | null;
+        hasActivityScope?: boolean;
       };
     },
     enabled: isAuthenticated,
@@ -352,6 +358,38 @@ function WithingsCard({
 
       <div className="mt-4 space-y-4">
         {errorMessage && <IntegrationErrorMessage message={errorMessage} />}
+        {/* v1.4.25 W5d — Withings activity-scope reconnect banner.
+            Only paints when (a) the user has an active Withings
+            connection (so the credentials are already saved + a token
+            exists) AND (b) the persisted scope is missing
+            `user.activity`. Reconnecting takes the user through the
+            standard /api/withings/connect → Withings → callback flow;
+            the callback persists the upgraded scope and the banner
+            vanishes on the next status poll. */}
+        {status?.connected && status?.hasActivityScope === false && (
+          <a
+            href="/api/withings/connect"
+            data-testid="withings-reconnect-banner"
+            className="border-warning/30 bg-warning/10 text-warning-foreground hover:bg-warning/20 block rounded-md border px-3 py-2 text-sm transition-colors"
+          >
+            <span className="font-medium">
+              {t(
+                "settings.integrations.withings.reconnect.banner.title",
+              )}
+            </span>
+            <span className="text-muted-foreground block text-xs">
+              {t(
+                "settings.integrations.withings.reconnect.banner.body",
+              )}
+            </span>
+            <span className="text-primary mt-1 inline-block text-xs font-medium">
+              {t(
+                "settings.integrations.withings.reconnect.banner.action",
+              )}
+              {" →"}
+            </span>
+          </a>
+        )}
         <div className="space-y-3">
           <h3 className="text-sm font-medium">
             {t("settings.withingsCredentials")}