feat(onboarding): add mandatory ConnectGarmin gate to first login

frontend/src/ConnectGarmin.tsx

@@ -0,0 +1,117 @@
+import { useState } from "react";
+import { api, BASE_URL } from "./api/client";
+import "./CreateProfile.css";
+import type { AuthResponse } from "./types/api";
+
+// Shown after CreateProfile (or on any later login, until it succeeds --
+// see LoginGate) since connecting Garmin is mandatory: the account exists
+// but this is the last gate before the main app. Deliberately not a reuse
+// of GarminConnection.tsx (the Profile page's version), which also renders
+// Sync now/Disconnect/Reset all -- none of which make sense here.
+export function ConnectGarmin({ onConnected }: { onConnected: () => void }) {
+  const [email, setEmail] = useState("");
+  const [password, setPassword] = useState("");
+  const [code, setCode] = useState("");
+  const [auth, setAuth] = useState<AuthResponse | null>(null);
+  const [busy, setBusy] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  async function connect(e: React.FormEvent) {
+    e.preventDefault();
+    if (!email.trim() || !password) {
+      setError("Please enter your Garmin email and password.");
+      return;
+    }
+    setBusy(true);
+    setError(null);
+    try {
+      const profile = await api.getProfile();
+      await api.updateProfile({ ...profile, GarminEmail: email.trim(), GarminPassword: password });
+      setAuth(await api.login());
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "Something went wrong, please try again.");
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  async function submitMFA() {
+    if (!code.trim()) return;
+    setBusy(true);
+    setError(null);
+    try {
+      setAuth(await api.submitMFA(code.trim()));
+      setCode("");
+    } catch (err) {
+      setError(err instanceof Error ? err.message : "Something went wrong, please try again.");
+    } finally {
+      setBusy(false);
+    }
+  }
+
+  const status = auth?.status;
+
+  return (
+    <div className="create-profile">
+      <h1>🧞‍♀️ Connect your Garmin account</h1>
+      <p>geniusrun needs your Garmin credentials to sync your activities.</p>
+
+      {status !== "authenticated" && status !== "mfa_required" && (
+        <form onSubmit={connect}>
+          <input
+            type="text"
+            placeholder="Garmin email"
+            value={email}
+            onChange={(e) => setEmail(e.target.value)}
+            disabled={busy}
+            autoFocus
+          />
+          <input
+            type="password"
+            placeholder="Garmin password"
+            value={password}
+            onChange={(e) => setPassword(e.target.value)}
+            disabled={busy}
+          />
+          <button type="submit" disabled={busy}>
+            {busy ? "Connecting…" : "Connect"}
+          </button>
+        </form>
+      )}
+
+      {status === "mfa_required" && (
+        <div className="create-profile-mfa">
+          <input
+            placeholder="MFA code"
+            value={code}
+            onChange={(e) => setCode(e.target.value)}
+            onKeyDown={(e) => e.key === "Enter" && submitMFA()}
+            disabled={busy}
+            autoFocus
+          />
+          <button type="button" disabled={busy} onClick={submitMFA}>
+            Submit code
+          </button>
+        </div>
+      )}
+
+      {status === "authenticated" && (
+        <>
+          <p className="create-profile-message">Connected to Garmin.</p>
+          <button type="button" onClick={onConnected}>
+            Continue to geniusrun
+          </button>
+        </>
+      )}
+
+      {auth?.message && status !== "authenticated" && <p className="create-profile-message">{auth.message}</p>}
+      {error && <p className="create-profile-error">{error}</p>}
+
+      <form method="post" action={`${BASE_URL}/api/session/logout`}>
+        <button type="submit" className="logout-link">
+          Log out
+        </button>
+      </form>
+    </div>
+  );
+}

frontend/src/CreateProfile.css

@@ -41,3 +41,16 @@
 .create-profile-error {
   color: #ef4444;
 }
+
+.create-profile-message {
+  margin: 0;
+  color: #9ca3af;
+}
+
+.create-profile-mfa {
+  display: flex;
+  flex-direction: column;
+  gap: 0.75rem;
+  width: 100%;
+  max-width: 320px;
+}

frontend/src/CreateProfile.tsx

@@ -1,11 +1,12 @@
 import { useState } from "react";
-import { api } from "./api/client";
+import { api, BASE_URL } from "./api/client";
 import "./CreateProfile.css";
 
 // Shown once, right after a brand-new OIDC login, before the account has a
-// geniusrun profile at all. The only thing asked for is a display name --
-// Garmin credentials and every other tunable are filled in afterward via
-// the existing Profile screen, same as a fresh single-user install today.
+// geniusrun profile at all. Only asks for a display name -- Garmin
+// credentials are collected next, on the ConnectGarmin screen (see
+// LoginGate), which every other tunable is still filled in afterward via
+// the existing Profile screen.
 export function CreateProfile({ onCreated }: { onCreated: (displayName: string) => void }) {
   const [displayName, setDisplayName] = useState("");
   const [submitting, setSubmitting] = useState(false);
@@ -32,7 +33,7 @@ export function CreateProfile({ onCreated }: { onCreated: (displayName: string)
   return (
     <div className="create-profile">
       <h1>🧞‍♀️ Welcome to geniusrun</h1>
-      <p>Let's set up your profile. You can add your Garmin account afterward.</p>
+      <p>Let's set up your profile. You'll connect your Garmin account next.</p>
       <form onSubmit={handleSubmit}>
         <input
           type="text"
@@ -47,6 +48,11 @@ export function CreateProfile({ onCreated }: { onCreated: (displayName: string)
           {submitting ? "Creating…" : "Continue"}
         </button>
       </form>
+      <form method="post" action={`${BASE_URL}/api/session/logout`}>
+        <button type="submit" className="logout-link">
+          Log out
+        </button>
+      </form>
     </div>
   );
 }

frontend/src/LoginGate.tsx

@@ -2,6 +2,7 @@ import { useEffect, useState } from "react";
 import { api, BASE_URL } from "./api/client";
 import "./LoginGate.css";
 import App from "./App";
+import { ConnectGarmin } from "./ConnectGarmin";
 import { CreateProfile } from "./CreateProfile";
 import type { SessionInfo } from "./types/api";
 
@@ -17,7 +18,10 @@ const AUTH_ERROR_MESSAGES: Record<string, string> = {
 // this is the first fork -- "show the login screen" vs "show the app." A
 // second fork, once authenticated, is whether the session's account has a
 // provisioned profile yet (session.has_profile) -- a brand-new OIDC login
-// sees CreateProfile instead of App until it submits one.
+// sees CreateProfile instead of App until it submits one. A third fork,
+// once provisioned, is whether Garmin has ever been successfully connected
+// (session.garmin_connected) -- mandatory, and re-checked on every login,
+// not just immediately after signup.
 export function LoginGate() {
   const [status, setStatus] = useState<Status>("loading");
   const [session, setSession] = useState<SessionInfo | null>(null);
@@ -57,5 +61,9 @@ export function LoginGate() {
     );
   }
 
+  if (!session!.garmin_connected) {
+    return <ConnectGarmin onConnected={() => setSession((s) => (s ? { ...s, garmin_connected: true } : s))} />;
+  }
+
   return <App session={session!} />;
 }

frontend/src/types/api.ts

@@ -191,6 +191,7 @@ export interface SessionInfo {
   email: string;
   has_profile: boolean;
   display_name?: string;
+  garmin_connected: boolean;
 }
 
 export interface DetailFillProgress {