feat(fitbit): add the Fitbit connection data model and FITBIT measurement source

Lay the data-model foundation for the Fitbit/Pixel integration over the
Google Health API, mirroring the WHOOP provider. No OAuth, sync, or UI yet.

- Prisma: FitbitConnection (1:1 per user, encrypted access/refresh tokens)
  and FitbitOAuthState models, two encrypted BYO-credential columns on User,
  and FITBIT appended to the MeasurementSource enum. Migration
  0117_v1120_fitbit_integration is additive only — one enum value plus two
  tables and two nullable columns, no new MeasurementType (every launch
  metric maps onto an existing type).
- Wire the two new encrypted columns and the FitbitConnection token columns
  into scripts/rotate-encryption-key.ts.
- FITBIT touchpoints: the read measurementSourceEnum (not the writable set),
  the DEFAULT_SOURCE_PRIORITY and workout-source ladders, the sources-section
  label map, the IntegrationKey union plus its display name, and a
  fitbit()/fitbitStatus() query-key pair. The source-rank SQL and read-tier
  collapse pick FITBIT up from the ladders with no code change.
- Add the FITBIT source label to all six locale bundles and regenerate the
  OpenAPI contract so the source enum carries FITBIT for the iOS decoder.

src/components/settings/sources-section.tsx

@@ -94,6 +94,8 @@ const SOURCE_LABEL_KEYS: Record<string, string> = {
   // `recovery` ladder for native-vs-derived ordering).
   WHOOP: "settings.sections.sources.sourceLabels.WHOOP",
   COMPUTED: "settings.sections.sources.sourceLabels.COMPUTED",
+  // v1.12.0 — Fitbit/Pixel native source.
+  FITBIT: "settings.sections.sources.sourceLabels.FITBIT",
 };
 
 const DEVICE_TYPE_LABEL_KEYS: Record<DeviceType, string> = {