feat(api): defer account creation until Garmin actually connects

backend/internal/api/session.go

@@ -98,6 +98,7 @@ func (s *Server) handleSessionCallback(w http.ResponseWriter, r *http.Request) {
 // (already deleted, in the profile-deletion case this exists for).
 func (s *Server) handleSessionLogout(w http.ResponseWriter, r *http.Request) {
 	claims, _ := auth.ClaimsFromContext(r.Context())
+	s.removeSetupSession(claims.Sub)
 	http.SetCookie(w, auth.ClearCookie(auth.SessionCookieName, s.Session.Secure))
 	http.Redirect(w, r, s.Auth.EndSessionURL(s.Session.FrontendURL+"/", claims.IDToken), http.StatusFound)
 }