feat(strava): add per-user BYO-OAuth workout source + Garmin indirect-path docs

Add Strava as a per-user BYO-OAuth workout source, mirroring the shipped
WHOOP/Oura/Polar pattern. Strava caps every new app at single-player mode, so
each self-hoster registers their own app and pastes the client id/secret into
Settings (falling back to a shared env app). Strava is a workout source only —
it exposes no daily metrics and no training-depth analytics are derived.

- Schema (migration 0233): per-user encrypted client id/secret + access/refresh
  tokens, plaintext athlete id, incremental cursor, and backfill marker on
  `User`; `STRAVA` added to `MeasurementSource`.
- Token model follows Oura's reactive-refresh-on-401 with a compare-and-set on
  the stored refresh ciphertext, because Strava rotates its refresh token on
  every refresh.
- Client over safeFetch: authorization-code + refresh, activity list + budget-
  aware per-activity detail (for calories/HR), honouring the 200/15min cap; each
  activity maps to one `Workout` row. Activity name/description stay in metadata
  as data, never surfaced or interpolated.
- Dedup reuses the existing source-agnostic two-layer picker: `STRAVA` slots
  into the workout ladder below the device-native wearables and above
  MANUAL/IMPORT, so an Apple-Watch + Strava twin collapses to one canonical row.
- Poll-cohort hourly sync (:17) + self-converging boot backfill, wired into the
  integration-sync registrar. Webhook deferred.
- OAuth routes (connect/callback/credentials/disconnect/status/test) with signed
  state, cross-account re-auth rejection, and a surgical `www.strava.com`
  connect-src gated to the Strava surfaces.
- Settings card + consolidated status envelope entry; env + compose whitelist;
  i18n across all six locales.
- Garmin: no direct connector is possible (business-partner-only). Add
  docs/integrations/garmin.md documenting the Apple Health / Google Health
  Connect path and Garmin's withheld proprietary scores, cross-linked from both
  platform docs, plus a non-connector info note in the Connections panel.

Regenerate docs/api/openapi.yaml for the new `STRAVA` MeasurementSource value.

src/app/api/integrations/status/route.ts

@@ -30,6 +30,7 @@ import {
 } from "@/lib/integrations/metric-freshness";
 import { getOuraClientCredentials } from "@/lib/oura/credentials";
 import { getPolarClientCredentials } from "@/lib/polar/credentials";
+import { getStravaClientCredentials } from "@/lib/strava/credentials";
 import { hasActivityScope } from "@/lib/withings/client";
 import { readMoodLogSecret } from "@/lib/moodlog-secret";
 
@@ -47,6 +48,7 @@ export const GET = apiHandler(async () => {
     googleHealthStatus,
     polarStatus,
     ouraStatus,
+    stravaStatus,
     dbUser,
     withingsConn,
     whoopConn,
@@ -58,6 +60,7 @@ export const GET = apiHandler(async () => {
     // /api/<provider>/status the consolidated envelope now replaces.
     polarAvailable,
     ouraAvailable,
+    stravaAvailable,
   ] = await Promise.all([
     getIntegrationStatus(user.id, "withings"),
     getIntegrationStatus(user.id, "moodlog"),
@@ -66,6 +69,7 @@ export const GET = apiHandler(async () => {
     getIntegrationStatus(user.id, "google-health"),
     getIntegrationStatus(user.id, "polar"),
     getIntegrationStatus(user.id, "oura"),
+    getIntegrationStatus(user.id, "strava"),
     prisma.user.findUnique({
       where: { id: user.id },
       select: {
@@ -83,6 +87,9 @@ export const GET = apiHandler(async () => {
         ouraAccessTokenEncrypted: true,
         ouraClientIdEncrypted: true,
         ouraClientSecretEncrypted: true,
+        stravaAccessTokenEncrypted: true,
+        stravaClientIdEncrypted: true,
+        stravaClientSecretEncrypted: true,
         moodLogUrlEncrypted: true,
         moodLogApiKeyEncrypted: true,
         moodLogEnabled: true,
@@ -133,6 +140,7 @@ export const GET = apiHandler(async () => {
     }),
     getPolarClientCredentials(user.id).then((c) => !!c),
     getOuraClientCredentials(user.id).then((c) => !!c),
+    getStravaClientCredentials(user.id).then((c) => !!c),
   ]);
 
   // F-SYNC-1 — per-metric-type last-value timestamps so the card can show that a
@@ -259,6 +267,18 @@ export const GET = apiHandler(async () => {
           !!dbUser?.ouraClientSecretEncrypted,
         metricFreshness: metricFreshness.oura ?? [],
       } satisfies IntegrationViewModel & OAuthProviderExtras,
+      {
+        ...stravaStatus,
+        connected: !!dbUser?.stravaAccessTokenEncrypted,
+        configured: !!dbUser?.stravaAccessTokenEncrypted,
+        available: stravaAvailable,
+        hasOwnCredentials:
+          !!dbUser?.stravaClientIdEncrypted &&
+          !!dbUser?.stravaClientSecretEncrypted,
+        // Strava writes Workout rows, not Measurements, so it has no
+        // per-metric measurement freshness (like moodLog).
+        metricFreshness: metricFreshness.strava ?? [],
+      } satisfies IntegrationViewModel & OAuthProviderExtras,
     ],
   });
 });