feat(fitbit): stop at the Web API turndown and point to Google Health

Google turns the legacy Fitbit Web API off on 30 October 2026 (support
ended on 30 September). From that day the hourly poll, the backfill,
the sleep repair and the token refresh make no call, the connect, sync
and test routes refuse with `provider_retired`, and the connection
reads as not connected to the health read and the watchdog, so the
shutdown pages nobody and asks nobody to reconnect. The connection row
and everything it imported stay.

The status envelope publishes `retirement` on the Fitbit entry (the
day, whether it has come, the successor), and the Fitbit card shows
when the connection stops, how to move to Google Health (same devices,
one more consent, tokens cannot be carried over) and that the data
stays; sync and connect grey out after the day. Both integrations can
run side by side meanwhile: every type Fitbit writes is laddered with
Fitbit just above Google Health, so a day both deliver counts once.

The test setups pin the turndown off, so the Fitbit suites do not turn
red on the day; the turndown's own tests flip it.

docs/api/openapi.yaml

@@ -20339,6 +20339,13 @@ paths:
               schema:
                 $ref: "#/components/schemas/ErrorEnvelope"
         "401": *a1
+        "410":
+          description: Google turned the legacy Fitbit Web API off on 2026-10-30; nothing is fetched. `meta.errorCode` =
+            `provider_retired`. The data already imported stays; Google Health reads the same devices.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorEnvelope"
         "413":
           description: Body exceeds 64 KiB.
           content:
@@ -20953,6 +20960,13 @@ paths:
               schema:
                 $ref: "#/components/schemas/FitbitIntegrationTestEnvelope"
         "401": *a1
+        "410":
+          description: Google turned the legacy Fitbit Web API off on 2026-10-30; nothing is probed. `meta.errorCode` =
+            `provider_retired`.
+          content:
+            application/json:
+              schema:
+                $ref: "#/components/schemas/ErrorEnvelope"
         "422": *a49
         "429": *a50
         "502": *a51
@@ -36298,8 +36312,8 @@ components:
                 health_score_config_conflict, insights_layout_conflict, invalid_base_updated_at,
                 json_carries_no_intake_time, json_not_an_array, medication_layout_conflict, missing_required_columns,
                 modules_conflict, mood_tag_layout_conflict, not_configured, notification_prefs_conflict, oidc_only,
-                private_origin_not_approved, private_origin_not_grantable, rate_limited_self, sync_in_progress,
-                too_many_rows, unreadable_json, upstream_invalid_json, vapid_not_configured"
+                private_origin_not_approved, private_origin_not_grantable, provider_retired, rate_limited_self,
+                sync_in_progress, too_many_rows, unreadable_json, upstream_invalid_json, vapid_not_configured"
               type: string
             capability:
               description: "On an AI refusal: the capability that is unavailable, one of the keys of `AiCapabilities` (`coach`,
@@ -79322,13 +79336,36 @@ components:
         allowPrivateHost:
           description: Nightscout only.
           type: boolean
+        retirement:
+          description: Fitbit only. The end of the legacy Fitbit Web API.
+          type: object
+          properties:
+            endsOn:
+              type: string
+              pattern: ^\d{4}-\d{2}-\d{2}$
+              description: The day Google turns the legacy Fitbit Web API off.
+            ended:
+              type: boolean
+              description: "The day has come: the connection no longer syncs, its imported data stays, and `health` is null."
+            successor:
+              type: string
+              enum:
+                - google-health
+              description: The integration that reads the same Fitbit and Pixel devices. Moving needs a fresh consent; the Fitbit
+                grant cannot be carried over.
+          required:
+            - endsOn
+            - ended
+            - successor
+          additionalProperties: false
         health:
           anyOf:
             - $ref: "#/components/schemas/ConnectionHealth"
             - type: "null"
-          description: The unified connection state, null when the provider is not connected. It supersedes `state`, `lastError`,
-            `consecutiveFailuresByKind`, `syncHealth`, `tokenExpired`, `needsReauth`, `hasActivityScope`,
-            `planUnavailable` and `scopeReconnect` on this entry; those nine are deprecated and removed in v1.44.
+          description: The unified connection state, null when the provider is not connected (and for Fitbit once
+            `retirement.ended`). It supersedes `state`, `lastError`, `consecutiveFailuresByKind`, `syncHealth`,
+            `tokenExpired`, `needsReauth`, `hasActivityScope`, `planUnavailable` and `scopeReconnect` on this entry;
+            those nine are deprecated and removed in v1.44.
       required:
         - integration
         - state