feat(garmin): sync Garmin Connect through the Personal API

Garmin Connect now offers a Personal API: a person creates a key for
their own account and any client can buy short-lived tokens with it.
HealthLog takes that key in a new Garmin card, checks it with Garmin
before storing it sealed on the user row, and polls every hour.

- Transport: key exchange with a per-process token cache keyed on the
  key, one re-exchange on a refused token and then reauth_required, the
  429 Retry-After carried to the caller, the China host tried when the
  global one does not know the key, answers read with a byte cap, all
  egress through safeFetch to the two fixed hosts.
- Sync: daily summaries, sleep summaries, HRV, weigh-ins and the
  activity search, chunked to each resource's documented range, read one
  after another and stopped at the first rate limit; today's menstrual
  cycle summary adds logged period days the person has not logged.
- Backfill: a resumable walk through the shared admission lane that
  learns where the history starts from the daily summaries and the
  activities, waits out Garmin's rate limit and stamps its marker.
- Types: GARMIN source; BODY_BATTERY and STRESS_LEVEL for Garmin's own
  day scores, kept apart from the computed STRESS_SCORE; TRAINING_READINESS
  and ACUTE_TRAINING_LOAD for figures a bridge pushes through the ingest
  token. All four chart on the recovery page and sit on the ladders,
  units, ranges, labels and report groups like the device-native scores.
- Key expiry: learned from a token capped short of a day, else estimated
  from the validity picked at connect; the card warns a week ahead and
  asks for a new key once Garmin refuses the old one.
- Ledger, health, freshness, watchdog, backup classes, wipe plan,
  encrypted-column registry, rotation script, OpenAPI and all ten
  locales carry the new integration. The old "no Garmin connector" note
  is gone.

src/lib/logging/__tests__/redact.test.ts

@@ -3,6 +3,12 @@ import { describe, expect, it } from "vitest";
 import { redactSecrets, redactOptional, PATH_SECRET_PATHS } from "../redact";
 
 describe("redactSecrets", () => {
+  it("redacts a Garmin Personal API key header", () => {
+    expect(redactSecrets("Authorization: ApiKey made-up-key-0001")).toBe(
+      "Authorization: ApiKey [REDACTED]",
+    );
+  });
+
   it("redacts Bearer tokens", () => {
     expect(redactSecrets("Authorization: Bearer hlk_abc123def456")).toBe(
       "Authorization: Bearer [REDACTED]",

src/lib/logging/redact.ts

@@ -125,6 +125,8 @@ export function redactSecrets(input: string): string {
   return (
     redactPathSegments(redactPrismaInvocation(input))
       .replace(/Bearer\s+\S+/gi, "Bearer [REDACTED]")
+      // A Garmin Personal API key rides as `Authorization: ApiKey <key>`.
+      .replace(/\bApiKey\s+\S+/g, "ApiKey [REDACTED]")
       .replace(/bot\d+:[A-Za-z0-9_-]+/g, "bot[REDACTED]")
       // `sk-` is a common English-prefix substring (task-force, risk-
       // management, disk-io). Without a word-boundary, the original