config: add per-user Garmin token store root and legacy-owner bootstrap var

GarminTokenStore is renamed GarminTokenStoreRoot to reflect that it now
roots one subdirectory per user rather than a single session cache path.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/internal/config/config.go

@@ -24,9 +24,13 @@ type Config struct {
 	GarminPythonPath string
 	// GarminServerPath is mcp-garmin's server.py.
 	GarminServerPath string
-	// GarminTokenStore, if set, overrides mcp-garmin's default ~/.garth
-	// session cache location.
-	GarminTokenStore string
+	// GarminTokenStoreRoot, if set, is the root directory under which each
+	// user's mcp-garmin session cache lives (one subdirectory per user id,
+	// e.g. "<root>/3"), overriding mcp-garmin's default ~/.garth. Read from
+	// the same GARMIN_TOKENSTORE env var as before Task 1's per-user
+	// scoping -- only its meaning changed (a root directory rather than a
+	// single path).
+	GarminTokenStoreRoot string
 
 	MinConfidence        float64
 	IncrementalSyncEvery time.Duration
@@ -45,6 +49,13 @@ type Config struct {
 	SessionSecret    []byte
 	SessionDuration  time.Duration
 	SessionSecure    bool
+
+	// LegacyOwnerOIDCSub, if set, is used exactly once at startup (via
+	// store.ClaimLegacyOwner) to bind this deployment's pre-existing
+	// single-tenant data to one named OIDC subject after upgrading to
+	// per-user profiles. Safe to leave set indefinitely -- ClaimLegacyOwner
+	// no-ops once any user already exists.
+	LegacyOwnerOIDCSub string
 }
 
 // Load reads configuration from environment variables, applying defaults
@@ -55,7 +66,7 @@ func Load() (Config, error) {
 		DBPath:               getEnvDefault("GENIUSRUN_DB_PATH", "geniusrun.db"),
 		GarminPythonPath:     os.Getenv("MCP_GARMIN_PYTHON"),
 		GarminServerPath:     os.Getenv("MCP_GARMIN_SERVER"),
-		GarminTokenStore:     os.Getenv("GARMIN_TOKENSTORE"),
+		GarminTokenStoreRoot: os.Getenv("GARMIN_TOKENSTORE"),
 		MinConfidence:        getEnvFloat("GENIUSRUN_MIN_CONFIDENCE", 0.6),
 		IncrementalSyncEvery: getEnvDuration("GENIUSRUN_INCREMENTAL_SYNC_EVERY", 6*time.Hour),
 		PublicBaseURL:        strings.TrimRight(os.Getenv("GENIUSRUN_PUBLIC_BASE_URL"), "/"),
@@ -64,6 +75,7 @@ func Load() (Config, error) {
 		OIDCClientSecret:     os.Getenv("GENIUSRUN_OIDC_CLIENT_SECRET"),
 		OIDCRequiredRole:     getEnvDefault("GENIUSRUN_OIDC_REQUIRED_ROLE", "geniusrun-user"),
 		SessionDuration:      getEnvDuration("GENIUSRUN_SESSION_DURATION", 720*time.Hour),
+		LegacyOwnerOIDCSub:   os.Getenv("GENIUSRUN_LEGACY_OWNER_OIDC_SUB"),
 	}
 
 	if cfg.GarminPythonPath == "" {