feat(onboarding): replace CreateProfile/ConnectGarmin with a single deferred-commit wizard

frontend/src/api/client.ts

@@ -46,8 +46,20 @@ export const api = {
   // browser navigation. Logout must POST (see server.go's route), which an
   // <a href> can't do, hence the form.
   getSessionInfo: () => request<SessionInfo>("/api/session/me"),
-  setup: (displayName: string) =>
-    request<{ user_id: number; display_name: string }>("/api/setup", {
+  // Onboarding (pre-account) -- distinct from the Profile page's
+  // auth.login()/submitMFA() below, since these run before any account
+  // exists: the Garmin session they build is ephemeral (keyed by OIDC
+  // subject, not a user id) until setupComplete() actually creates the
+  // account. See docs/superpowers/specs/2026-07-26-onboarding-wizard-deferred-commit-design.md.
+  setupGarminLogin: (garminEmail: string, garminPassword: string) =>
+    request<AuthResponse>("/api/setup/garmin/login", {
+      method: "POST",
+      body: JSON.stringify({ garmin_email: garminEmail, garmin_password: garminPassword }),
+    }),
+  setupGarminMFA: (code: string) =>
+    request<AuthResponse>("/api/setup/garmin/mfa", { method: "POST", body: JSON.stringify({ code }) }),
+  setupComplete: (displayName: string) =>
+    request<{ user_id: number; display_name: string }>("/api/setup/complete", {
       method: "POST",
       body: JSON.stringify({ display_name: displayName }),
     }),