feat(garmin): sync Garmin Connect through the Personal API

Garmin Connect now offers a Personal API: a person creates a key for
their own account and any client can buy short-lived tokens with it.
HealthLog takes that key in a new Garmin card, checks it with Garmin
before storing it sealed on the user row, and polls every hour.

- Transport: key exchange with a per-process token cache keyed on the
  key, one re-exchange on a refused token and then reauth_required, the
  429 Retry-After carried to the caller, the China host tried when the
  global one does not know the key, answers read with a byte cap, all
  egress through safeFetch to the two fixed hosts.
- Sync: daily summaries, sleep summaries, HRV, weigh-ins and the
  activity search, chunked to each resource's documented range, read one
  after another and stopped at the first rate limit; today's menstrual
  cycle summary adds logged period days the person has not logged.
- Backfill: a resumable walk through the shared admission lane that
  learns where the history starts from the daily summaries and the
  activities, waits out Garmin's rate limit and stamps its marker.
- Types: GARMIN source; BODY_BATTERY and STRESS_LEVEL for Garmin's own
  day scores, kept apart from the computed STRESS_SCORE; TRAINING_READINESS
  and ACUTE_TRAINING_LOAD for figures a bridge pushes through the ingest
  token. All four chart on the recovery page and sit on the ladders,
  units, ranges, labels and report groups like the device-native scores.
- Key expiry: learned from a token capped short of a day, else estimated
  from the validity picked at connect; the card warns a week ahead and
  asks for a new key once Garmin refuses the old one.
- Ledger, health, freshness, watchdog, backup classes, wipe plan,
  encrypted-column registry, rotation script, OpenAPI and all ten
  locales carry the new integration. The old "no Garmin connector" note
  is gone.

src/lib/report-selection/__tests__/catalogue-guard.test.ts

@@ -63,9 +63,9 @@ function resolves(key: string): boolean {
 
 describe("report selection catalogue", () => {
   it("carries every measurement type and every structured leaf", () => {
-    expect(MEASUREMENT_LEAF_IDS).toHaveLength(86);
+    expect(MEASUREMENT_LEAF_IDS).toHaveLength(90);
     expect(STRUCTURED_LEAF_IDS).toHaveLength(20);
-    expect(ALL_LEAF_IDS).toHaveLength(106);
+    expect(ALL_LEAF_IDS).toHaveLength(110);
   });
 
   it("resolves a label for every leaf", () => {

src/lib/report-selection/catalogue.ts

@@ -116,6 +116,7 @@ export const MEASUREMENT_LEAF_GROUP: Record<MeasurementType, ReportGroupId> = {
   MAX_HEART_RATE: "cardio",
   CARDIO_RECOVERY: "cardio",
   CARDIO_LOAD: "cardio",
+  ACUTE_TRAINING_LOAD: "cardio",
   PULSE_WAVE_VELOCITY: "cardio",
   VASCULAR_AGE: "cardio",
   IRREGULAR_RHYTHM_NOTIFICATION: "cardio",
@@ -151,6 +152,9 @@ export const MEASUREMENT_LEAF_GROUP: Record<MeasurementType, ReportGroupId> = {
   STRESS_SCORE: "sleepRecovery",
   RESILIENCE: "sleepRecovery",
   ANS_CHARGE: "sleepRecovery",
+  BODY_BATTERY: "sleepRecovery",
+  STRESS_LEVEL: "sleepRecovery",
+  TRAINING_READINESS: "sleepRecovery",
   SKIN_TEMPERATURE: "sleepRecovery",
   WRIST_TEMPERATURE: "sleepRecovery",
   BODY_TEMPERATURE_DEVIATION: "sleepRecovery",
@@ -307,6 +311,10 @@ export const LEAF_MODULE: Partial<Record<ReportLeafId, ModuleKey>> = {
   STRESS_SCORE: "recovery",
   RESILIENCE: "recovery",
   ANS_CHARGE: "recovery",
+  BODY_BATTERY: "recovery",
+  STRESS_LEVEL: "recovery",
+  TRAINING_READINESS: "recovery",
+  ACUTE_TRAINING_LOAD: "workouts",
   // Sleep.
   SLEEP_DURATION: "sleep",
   SLEEP_SCORE: "sleep",