P1: garminconnect auth backend — live sync working again

garth's SSO login is Cloudflare-rate-limited (429) and garth is now
deprecated upstream. New openrun.ingest.garminconnect_backend authenticates
via python-garminconnect 0.3.5 DI Bearer tokens and shims garth's client
surface (connectapi/download/username), so the existing sync pipeline runs
unchanged. openrun-sync gains --backend {auto,garth,garminconnect}; auto
prefers garminconnect when .secrets/garmin_tokens.json exists.

Login: uv run python -m openrun.ingest.garminconnect_backend

Synced: 7 activities (-> 2026-06-02) + splits + FITs, wellness through
2026-06-12, time-in-zone recomputed (364 activities).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

NEXT_SESSION.md

@@ -21,10 +21,20 @@ architecture and conventions. Delete this file when the list is done.
   timestamps, no FITs). Copied to
   `data/backups/vault-root-takeout-ingest-2026-06-08.db`; the original at
   `../data/` is redundant once live sync runs — user should delete it.
-- **Sync is blocked on auth**: `.secrets/` is empty. User runs
-  `uv run openrun-auth` (password + MFA), then
-  `uv run openrun-sync --days 35` (covers the wellness gap since May 17;
-  activities + FITs are incremental automatically).
+- **SYNC DONE (2026-06-12)** via new garminconnect backend. garth's SSO login
+  is Cloudflare-429-blocked AND garth is deprecated (matin/garth#222), so
+  `src/openrun/ingest/garminconnect_backend.py` now authenticates with
+  python-garminconnect 0.3.5 DI tokens (`.secrets/garmin_tokens.json`) and
+  shims garth's client surface; `openrun-sync --backend=auto` prefers it.
+  This is P3-lite, pulled forward. Login (once/year-ish):
+  `uv run python -m openrun.ingest.garminconnect_backend`.
+  Gotchas learned: usersummary endpoint needs UUID displayName, not userName
+  (403 otherwise); a parseable-but-dead tokenstore blocks the password
+  fallback in gc.login (main() parks it as .bak first).
+- DB after sync: 385 activities (→ 2026-06-02), all ISO timestamps on new
+  rows, 356 FITs linked, 364 TIZ rows, wellness through 2026-06-12.
+  The 18 legacy epoch-ms rows remain (P2). Web Sync page still uses the
+  garth login flow — port it to the gc backend (or hide login) later.
 - `race_plan` table is EMPTY and `manual_activities` empty, but openrun.toml
   has races: 30K 2026-06-13, 50K 2026-07-25, 50 MILE 2026-09-12.
 - Known bugs: 18 activities have epoch-ms floats in `start_time_local`