feat: support updating Garmin credentials at runtime

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/internal/garmin/client.go

@@ -24,6 +24,12 @@ type Client interface {
 	Authenticate(ctx context.Context) (AuthResult, error)
 	// CompleteMFA submits an MFA code for a login started by Authenticate.
 	CompleteMFA(ctx context.Context, code string) (AuthResult, error)
+	// UpdateCredentials replaces the Garmin email/password used to spawn
+	// the subprocess, and terminates any already-running subprocess (which
+	// would otherwise still be authenticated under the old credentials).
+	// The next call that needs the subprocess spawns a fresh one with the
+	// new credentials.
+	UpdateCredentials(email, password string)
 	// GetActivities lists activities between start and end (YYYY-MM-DD).
 	GetActivities(ctx context.Context, startDate, endDate string, limit int) ([]Activity, error)
 	// GetActivitySplits fetches lap/split summaries for one activity.
@@ -97,6 +103,23 @@ func (c *mcpClient) ensureStarted(ctx context.Context) error {
 	return nil
 }
 
+// UpdateCredentials implements Client.
+func (c *mcpClient) UpdateCredentials(email, password string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	c.cfg.GarminEmail = email
+	c.cfg.GarminPassword = password
+
+	if c.started {
+		if c.inner != nil {
+			c.inner.Close()
+		}
+		c.inner = nil
+		c.started = false
+	}
+}
+
 // drainStderr forwards the subprocess's debug/log output so it isn't
 // silently dropped (mcp-garmin logs auth/rate-limit diagnostics there).
 func drainStderr(stdio *transport.Stdio) {