feat(api): GET/PUT /api/config serving app + env configuration

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/internal/api/server.go

@@ -48,6 +48,12 @@ type Server struct {
 	GarminBase garmin.Config
 	SyncConfig appsync.Config
 
+	// EnvVars is the read-only, display-safe environment-configuration
+	// snapshot served by GET /api/config -- built once in main.go from
+	// config.Config.DisplayEnv() (secrets already masked there); handlers
+	// never call os.Getenv.
+	EnvVars []EnvVar
+
 	mu              sync.Mutex
 	userGarmin      map[int64]garmin.Client
 	userSync        map[int64]*appsync.Service
@@ -363,6 +369,9 @@ func (s *Server) Router() http.Handler {
 
 				r.Post("/reclassify", s.handleReclassifyAll)
 
+				r.Get("/config", s.handleGetConfig)
+				r.Put("/config", s.handlePutConfig)
+
 				r.Get("/progression/{kindID}", s.handleProgression)
 			})
 		})