refactor(log): unified schema — mandatory type/class/method, request_id removed

Every log record now carries type ('http' for the request middleware
line, 'wrapper' for garmin execute() calls and forwarded wrapper.py
stderr, 'app' for everything else), class (Go type with package, or the
package/module for free functions), and method (the emitting Go/Python
function -- wrapper.py stamps it automatically, so its msg prefixes are
gone). msg is optional and omitted when empty; the redundant messages
('HTTP request', 'wrapper call', 'garmin wrapper stderr') are dropped,
the HTTP verb moves to http_method, source=garmin-wrapper is replaced by
type=wrapper, and the request_id middleware plumbing (applog
WithLogger/FromContext) is removed. applog.App(class, method) is the
tagging helper for app records.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/internal/api/setup_test.go

@@ -254,3 +254,64 @@ func unmarshalBody(t *testing.T, rec *httptest.ResponseRecorder, v any) {
 		t.Fatalf("unmarshal response body %q: %v", rec.Body.String(), err)
 	}
 }
+
+// Regression: os.Rename refuses to replace an existing directory, so a
+// stale {userID} token-store dir (left behind when the DB file was
+// recreated -- ids restart at 1 -- while the token-store root survived)
+// used to make setup completion silently keep the OLD tokens in place.
+// The fresh, just-validated session's directory must win.
+func TestSetupComplete_ReplacesStaleTokenStoreDir(t *testing.T) {
+	db, err := store.Open(filepath.Join(t.TempDir(), "setup_stale_dir_test.db"))
+	if err != nil {
+		t.Fatalf("store.Open: %v", err)
+	}
+	t.Cleanup(func() { db.Close() })
+	m := &garmin.MockClient{}
+	tokenStoreRoot := t.TempDir()
+	s := NewServer(db, func(garmin.ClientConfig) garmin.Client { return m }, garmin.ClientConfig{TokenStorePath: tokenStoreRoot}, garmin.SyncConfig{}, &authmock.Verifier{}, testSessionConfig)
+	router := s.Router()
+
+	// The ephemeral setup dir the wrapper would have written tokens into.
+	setupDir := setupTokenStoreDir(tokenStoreRoot, "test-user")
+	if err := os.MkdirAll(setupDir, 0o755); err != nil {
+		t.Fatalf("mkdir setup dir: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(setupDir, "oauth_token"), []byte("fresh"), 0o600); err != nil {
+		t.Fatalf("write fresh token: %v", err)
+	}
+	// A stale dir already occupying the permanent {userID} path (fresh DB
+	// starts ids at 1).
+	staleDir := filepath.Join(tokenStoreRoot, "1")
+	if err := os.MkdirAll(staleDir, 0o755); err != nil {
+		t.Fatalf("mkdir stale dir: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(staleDir, "oauth_token"), []byte("stale"), 0o600); err != nil {
+		t.Fatalf("write stale token: %v", err)
+	}
+
+	rec := doJSON(t, router, http.MethodPost, "/api/setup/garmin/login", map[string]any{
+		"garmin_email": "runner@example.com", "garmin_password": "hunter2",
+	})
+	if rec.Code != http.StatusOK {
+		t.Fatalf("login status = %d, body = %s", rec.Code, rec.Body.String())
+	}
+	rec = doJSON(t, router, http.MethodPost, "/api/setup/complete", map[string]any{"display_name": "Lucie"})
+	if rec.Code != http.StatusOK {
+		t.Fatalf("complete status = %d, body = %s", rec.Code, rec.Body.String())
+	}
+
+	u, found, err := db.GetUserBySub(newCtx(), "test-user")
+	if err != nil || !found {
+		t.Fatalf("GetUserBySub: found=%v err=%v", found, err)
+	}
+	token, err := os.ReadFile(filepath.Join(tokenStoreRoot, itoa(u.ID), "oauth_token"))
+	if err != nil {
+		t.Fatalf("read token after complete: %v", err)
+	}
+	if string(token) != "fresh" {
+		t.Fatalf("token content = %q, want the fresh setup session to replace the stale dir", token)
+	}
+	if _, err := os.Stat(setupDir); !os.IsNotExist(err) {
+		t.Errorf("ephemeral setup dir still present after rename: %v", err)
+	}
+}