feat(fitbit): add the Google Health settings card with connection test and resume

Give the Google Health (Fitbit & Pixel) integration the same settings-card
parity WHOOP and Withings already have. It is a BYO-key provider — the user
pastes their own Google OAuth client id/secret, then connects — so the card
mirrors the WHOOP flow rather than the server-brokered Withings one.

- New POST /api/integrations/fitbit/test does a live, rate-limited
  (5/60s per user) probe against the Google Health profile endpoint via
  the refreshed token from getValidToken, returning { ok, latencyMs,
  lastSyncedAt } and the same error-code union WHOOP uses. The Bearer
  token and upstream host are scrubbed before any annotation.
- New POST /api/integrations/fitbit/resume clears a parked integration
  via resumeIntegrationFromPark, rate-limited to match the test route.
- FitbitCard renders the credentials form, OAuth connect, sync now /
  sync all data / test connection / disconnect action row, the parked
  resume banner, and a backfill-in-progress line. Status reads from the
  existing /api/fitbit/status; the pill/error/parked state comes off the
  cross-integration envelope, which now carries a fitbit entry.
- Card strings added under settings.fitbit* across all six locales.

src/app/api/integrations/status/route.ts

@@ -29,41 +29,60 @@ export const GET = apiHandler(async () => {
   const { user } = await requireAuth();
   annotate({ action: { name: "integrations.status" } });
 
-  const [withingsStatus, moodLogStatus, whoopStatus, dbUser, withingsConn, whoopConn] =
-    await Promise.all([
-      getIntegrationStatus(user.id, "withings"),
-      getIntegrationStatus(user.id, "moodlog"),
-      getIntegrationStatus(user.id, "whoop"),
-      prisma.user.findUnique({
-        where: { id: user.id },
-        select: {
-          withingsClientIdEncrypted: true,
-          withingsClientSecretEncrypted: true,
-          whoopClientIdEncrypted: true,
-          whoopClientSecretEncrypted: true,
-          moodLogUrlEncrypted: true,
-          moodLogApiKeyEncrypted: true,
-          moodLogEnabled: true,
-          moodLogLastSyncedAt: true,
-        },
-      }),
-      prisma.withingsConnection.findUnique({
-        where: { userId: user.id },
-        select: {
-          tokenExpiresAt: true,
-          lastSyncedAt: true,
-          createdAt: true,
-        },
-      }),
-      prisma.whoopConnection.findUnique({
-        where: { userId: user.id },
-        select: {
-          tokenExpiresAt: true,
-          lastSyncedAt: true,
-          createdAt: true,
-        },
-      }),
-    ]);
+  const [
+    withingsStatus,
+    moodLogStatus,
+    whoopStatus,
+    fitbitStatus,
+    dbUser,
+    withingsConn,
+    whoopConn,
+    fitbitConn,
+  ] = await Promise.all([
+    getIntegrationStatus(user.id, "withings"),
+    getIntegrationStatus(user.id, "moodlog"),
+    getIntegrationStatus(user.id, "whoop"),
+    getIntegrationStatus(user.id, "fitbit"),
+    prisma.user.findUnique({
+      where: { id: user.id },
+      select: {
+        withingsClientIdEncrypted: true,
+        withingsClientSecretEncrypted: true,
+        whoopClientIdEncrypted: true,
+        whoopClientSecretEncrypted: true,
+        fitbitClientIdEncrypted: true,
+        fitbitClientSecretEncrypted: true,
+        moodLogUrlEncrypted: true,
+        moodLogApiKeyEncrypted: true,
+        moodLogEnabled: true,
+        moodLogLastSyncedAt: true,
+      },
+    }),
+    prisma.withingsConnection.findUnique({
+      where: { userId: user.id },
+      select: {
+        tokenExpiresAt: true,
+        lastSyncedAt: true,
+        createdAt: true,
+      },
+    }),
+    prisma.whoopConnection.findUnique({
+      where: { userId: user.id },
+      select: {
+        tokenExpiresAt: true,
+        lastSyncedAt: true,
+        createdAt: true,
+      },
+    }),
+    prisma.fitbitConnection.findUnique({
+      where: { userId: user.id },
+      select: {
+        tokenExpiresAt: true,
+        lastSyncedAt: true,
+        createdAt: true,
+      },
+    }),
+  ]);
 
   const now = Date.now();
 
@@ -106,6 +125,19 @@ export const GET = apiHandler(async () => {
           ? whoopConn.tokenExpiresAt.getTime() <= now
           : null,
       } satisfies IntegrationViewModel & WhoopExtras,
+      {
+        ...fitbitStatus,
+        configured:
+          !!dbUser?.fitbitClientIdEncrypted &&
+          !!dbUser?.fitbitClientSecretEncrypted,
+        connected: !!fitbitConn,
+        connectedAt: fitbitConn?.createdAt?.toISOString() ?? null,
+        legacyLastSyncedAt: fitbitConn?.lastSyncedAt?.toISOString() ?? null,
+        tokenExpiresAt: fitbitConn?.tokenExpiresAt?.toISOString() ?? null,
+        tokenExpired: fitbitConn
+          ? fitbitConn.tokenExpiresAt.getTime() <= now
+          : null,
+      } satisfies IntegrationViewModel & FitbitExtras,
     ],
   });
 });
@@ -141,3 +173,12 @@ interface WhoopExtras {
   tokenExpiresAt: string | null;
   tokenExpired: boolean | null;
 }
+
+interface FitbitExtras {
+  configured: boolean;
+  connected: boolean;
+  connectedAt: string | null;
+  legacyLastSyncedAt: string | null;
+  tokenExpiresAt: string | null;
+  tokenExpired: boolean | null;
+}