fix(onboarding): offer Garmin as a source

The setup question about where readings come from listed every other
connection on Settings and not Garmin, so the flow could neither record it
nor end on connecting it. Garmin is now a Q4 source and a browser
connectable one: the key is pasted on its card, so nothing can be missing
up front.

A guard now pins that every connection the health read covers is either an
onboarding source or named with the reason it is not.

Refs #1333

docs/api/openapi.yaml

@@ -36694,7 +36694,7 @@ components:
               type: string
               const: done
             sources:
-              maxItems: 10
+              maxItems: 11
               type: array
               items:
                 type: string
@@ -36705,6 +36705,7 @@ components:
                   - oura
                   - whoop
                   - polar
+                  - garmin
                   - fitbit
                   - strava
                   - nightscout
@@ -83103,6 +83104,7 @@ components:
               - oura
               - whoop
               - polar
+              - garmin
               - fitbit
               - strava
               - nightscout