feat(api): persist and expose garmin_connected on successful auth

backend/internal/api/isolation_test.go

@@ -181,3 +181,25 @@ func TestIsolation_DeleteProfileOnlyDeletesOwnAccount(t *testing.T) {
 		t.Fatalf("userA profile status after userB deleted themselves = %d, body = %s", rec.Code, rec.Body.String())
 	}
 }
+
+// TestIsolation_GarminConnectedNeverLeaksAcrossUsers confirms one user's
+// successful Garmin auth never flips garmin_connected for another user.
+func TestIsolation_GarminConnectedNeverLeaksAcrossUsers(t *testing.T) {
+	s, db, _ := newTestServer(t) // provisions "test-user" (userA)
+	if _, err := db.ProvisionUser(newCtx(), "user-b", "B"); err != nil {
+		t.Fatalf("ProvisionUser(b): %v", err)
+	}
+
+	router := s.Router()
+	rec := doJSON(t, router, http.MethodPost, "/api/auth/login", nil) // as userA
+	if rec.Code != http.StatusOK {
+		t.Fatalf("auth/login status = %d, body = %s", rec.Code, rec.Body.String())
+	}
+
+	rec = doJSONAs(t, router, "user-b", http.MethodGet, "/api/session/me", nil)
+	var meB sessionMeResponse
+	unmarshalBody(t, rec, &meB)
+	if meB.GarminConnected {
+		t.Fatal("userA's successful Garmin auth leaked into userB's garmin_connected flag")
+	}
+}