docs: fix stale env-var docs, document validateProfile's zone-range rationale

Two Minor findings from the final whole-branch review: the smartrun-dev
skill still told developers to set GARMIN_EMAIL/GARMIN_PASSWORD (now
sourced from the profile row instead), and validateProfile's deliberate
choice not to require 0-100% HR zone coverage had no explanation.

backend/internal/api/profile.go

@@ -8,6 +8,11 @@ import (
 	"smartrun/backend/internal/store"
 )
 
+// validateProfile checks the HR zones are ascending and gap-free once they
+// start, but deliberately does NOT require zone 1 to start at 0% or zone 5
+// to end at 100%: real Karvonen HR training zones (e.g. the seeded defaults,
+// 50-60/60-70/70-80/80-90/90-100) don't cover the 0-50% range at all --
+// below zone 1 simply isn't a named training zone.
 func validateProfile(p store.Profile) error {
 	if p.RestingHeartRate != nil && p.MaxHeartRate != nil && *p.RestingHeartRate >= *p.MaxHeartRate {
 		return errors.New("resting heart rate must be less than max heart rate")