feat(onboarding): add mandatory ConnectGarmin gate to first login

frontend/src/LoginGate.tsx

@@ -2,6 +2,7 @@ import { useEffect, useState } from "react";
 import { api, BASE_URL } from "./api/client";
 import "./LoginGate.css";
 import App from "./App";
+import { ConnectGarmin } from "./ConnectGarmin";
 import { CreateProfile } from "./CreateProfile";
 import type { SessionInfo } from "./types/api";
 
@@ -17,7 +18,10 @@ const AUTH_ERROR_MESSAGES: Record<string, string> = {
 // this is the first fork -- "show the login screen" vs "show the app." A
 // second fork, once authenticated, is whether the session's account has a
 // provisioned profile yet (session.has_profile) -- a brand-new OIDC login
-// sees CreateProfile instead of App until it submits one.
+// sees CreateProfile instead of App until it submits one. A third fork,
+// once provisioned, is whether Garmin has ever been successfully connected
+// (session.garmin_connected) -- mandatory, and re-checked on every login,
+// not just immediately after signup.
 export function LoginGate() {
   const [status, setStatus] = useState<Status>("loading");
   const [session, setSession] = useState<SessionInfo | null>(null);
@@ -57,5 +61,9 @@ export function LoginGate() {
     );
   }
 
+  if (!session!.garmin_connected) {
+    return <ConnectGarmin onConnected={() => setSession((s) => (s ? { ...s, garmin_connected: true } : s))} />;
+  }
+
   return <App session={session!} />;
 }