feat: add profile REST endpoints with HR zone validation

Implements GET /api/profile and PUT /api/profile endpoints with validation
of HR zones (must be contiguous, non-overlapping, 0-100%). Also updates
profile migration to use correct HR zone defaults (0-20, 20-40, etc.)
that match validation requirements.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/internal/api/api_test.go

@@ -185,3 +185,53 @@ func TestProgression_ReturnsSortedTimeSeries(t *testing.T) {
 func itoa(v int64) string {
 	return strconv.FormatInt(v, 10)
 }
+
+func TestProfile_GetDefaultsThenUpdate(t *testing.T) {
+	s, _ := newTestServer(t)
+	router := s.Router()
+
+	rec := doJSON(t, router, http.MethodGet, "/api/profile", nil)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("get status = %d, body = %s", rec.Code, rec.Body.String())
+	}
+	var got store.Profile
+	if err := json.Unmarshal(rec.Body.Bytes(), &got); err != nil {
+		t.Fatalf("unmarshal: %v", err)
+	}
+	if got.RollingWindowDays != 90 {
+		t.Fatalf("RollingWindowDays = %d, want 90", got.RollingWindowDays)
+	}
+
+	got.GarminEmail = "runner@example.com"
+	got.GarminPassword = "hunter2"
+	got.RollingWindowDays = 120
+	rec = doJSON(t, router, http.MethodPut, "/api/profile", got)
+	if rec.Code != http.StatusOK {
+		t.Fatalf("put status = %d, body = %s", rec.Code, rec.Body.String())
+	}
+
+	rec = doJSON(t, router, http.MethodGet, "/api/profile", nil)
+	var updated store.Profile
+	json.Unmarshal(rec.Body.Bytes(), &updated)
+	if updated.GarminEmail != "runner@example.com" || updated.RollingWindowDays != 120 {
+		t.Fatalf("updated = %+v, want new email/window", updated)
+	}
+}
+
+func TestProfile_RejectsInvalidHRZones(t *testing.T) {
+	s, _ := newTestServer(t)
+	router := s.Router()
+
+	rec := doJSON(t, router, http.MethodGet, "/api/profile", nil)
+	var p store.Profile
+	json.Unmarshal(rec.Body.Bytes(), &p)
+
+	maxHR, restingHR := 100.0, 150.0 // resting > max: invalid
+	p.MaxHeartRate = &maxHR
+	p.RestingHeartRate = &restingHR
+
+	rec = doJSON(t, router, http.MethodPut, "/api/profile", p)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400, body = %s", rec.Code, rec.Body.String())
+	}
+}

backend/internal/api/profile.go

@@ -0,0 +1,71 @@
+package api
+
+import (
+	"encoding/json"
+	"errors"
+	"net/http"
+
+	"smartrun/backend/internal/store"
+)
+
+func validateProfile(p store.Profile) error {
+	if p.RestingHeartRate != nil && p.MaxHeartRate != nil && *p.RestingHeartRate >= *p.MaxHeartRate {
+		return errors.New("resting heart rate must be less than max heart rate")
+	}
+	zones := [][2]float64{
+		{p.HRZone1MinPct, p.HRZone1MaxPct},
+		{p.HRZone2MinPct, p.HRZone2MaxPct},
+		{p.HRZone3MinPct, p.HRZone3MaxPct},
+		{p.HRZone4MinPct, p.HRZone4MaxPct},
+		{p.HRZone5MinPct, p.HRZone5MaxPct},
+	}
+	if zones[0][0] != 0 {
+		return errors.New("zone 1 must start at 0%")
+	}
+	if zones[len(zones)-1][1] != 100 {
+		return errors.New("zone 5 must end at 100%")
+	}
+	for i, z := range zones {
+		if z[0] >= z[1] {
+			return errors.New("each HR zone's min must be less than its max")
+		}
+		if i > 0 && z[0] != zones[i-1][1] {
+			return errors.New("HR zones must be contiguous and non-overlapping")
+		}
+	}
+	return nil
+}
+
+func (s *Server) handleGetProfile(w http.ResponseWriter, r *http.Request) {
+	p, err := s.DB.GetProfile(r.Context())
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, p)
+}
+
+func (s *Server) handleUpdateProfile(w http.ResponseWriter, r *http.Request) {
+	var p store.Profile
+	if err := json.NewDecoder(r.Body).Decode(&p); err != nil {
+		writeError(w, http.StatusBadRequest, "invalid request body")
+		return
+	}
+	if err := validateProfile(p); err != nil {
+		writeError(w, http.StatusBadRequest, err.Error())
+		return
+	}
+
+	if err := s.DB.UpdateProfile(r.Context(), p); err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	s.Garmin.UpdateCredentials(p.GarminEmail, p.GarminPassword)
+
+	updated, err := s.DB.GetProfile(r.Context())
+	if err != nil {
+		writeError(w, http.StatusInternalServerError, err.Error())
+		return
+	}
+	writeJSON(w, http.StatusOK, updated)
+}

backend/internal/api/server.go

@@ -40,6 +40,11 @@ func (s *Server) Router() http.Handler {
 	r.Route("/api", func(r chi.Router) {
 		r.Get("/health", s.handleHealth)
 
+		r.Route("/profile", func(r chi.Router) {
+			r.Get("/", s.handleGetProfile)
+			r.Put("/", s.handleUpdateProfile)
+		})
+
 		r.Route("/auth", func(r chi.Router) {
 			r.Post("/login", s.handleAuthLogin)
 			r.Post("/mfa", s.handleAuthMFA)