feat(garmin): implement Authenticate/CompleteMFA on subprocessClient

Structured {status, message} responses replace the old string
pattern-matching (parseAuthResult) -- both sides of the protocol are now
owned by this repo, so there's no need to guess at phrasing anymore.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/internal/garmin/client.go

@@ -225,6 +225,42 @@ func (c *subprocessClient) roundTrip(cmdName string, params any) (json.RawMessag
 	return resp.Result, nil
 }
 
+func (c *subprocessClient) Authenticate(ctx context.Context) (AuthResult, error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if err := c.ensureStarted(); err != nil {
+		return AuthResult{}, err
+	}
+	raw, err := c.roundTrip("authenticate", nil)
+	if err != nil {
+		return AuthResult{}, err
+	}
+	var wire authResultWire
+	if err := json.Unmarshal(raw, &wire); err != nil {
+		return AuthResult{}, fmt.Errorf("parse authenticate result: %w", err)
+	}
+	return AuthResult{Status: mapAuthStatus(wire.Status), Message: wire.Message}, nil
+}
+
+func (c *subprocessClient) CompleteMFA(ctx context.Context, code string) (AuthResult, error) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if err := c.ensureStarted(); err != nil {
+		return AuthResult{}, err
+	}
+	raw, err := c.roundTrip("complete_mfa", map[string]any{"code": code})
+	if err != nil {
+		return AuthResult{}, err
+	}
+	var wire authResultWire
+	if err := json.Unmarshal(raw, &wire); err != nil {
+		return AuthResult{}, fmt.Errorf("parse complete_mfa result: %w", err)
+	}
+	return AuthResult{Status: mapAuthStatus(wire.Status), Message: wire.Message}, nil
+}
+
 // UpdateCredentials implements Client.
 func (c *subprocessClient) UpdateCredentials(email, password string) {
 	c.mu.Lock()