refactor: merge internal/sync into internal/garmin, regroup api files and routes

Garmin auth/sync routes move under /api/garmin/*; sync.Service becomes
garmin.Sync with garmin.SyncConfig/ClientConfig; applog becomes
internal/log; the test mock moves into the garmin package as MockClient
(breaking the test-only import cycle the merge created); stale test
URLs and type names updated to match.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/internal/api/isolation_test.go

@@ -10,9 +10,7 @@ import (
 	"geniusrun/backend/internal/auth"
 	authmock "geniusrun/backend/internal/auth/mock"
 	"geniusrun/backend/internal/garmin"
-	"geniusrun/backend/internal/garmin/mock"
 	"geniusrun/backend/internal/store"
-	appsync "geniusrun/backend/internal/sync"
 )
 
 // doJSONAs is doJSON but for an explicit session Sub, for tests that need
@@ -150,8 +148,8 @@ func TestIsolation_RequireProvisionedUser_BlocksDataRoutesUntilSetup(t *testing.
 		t.Fatalf("store.Open: %v", err)
 	}
 	defer db.Close()
-	m := &mock.Client{}
-	s := NewServer(db, func(garmin.Config) garmin.Client { return m }, garmin.Config{}, appsync.Config{}, &authmock.Verifier{}, testSessionConfig)
+	m := &garmin.MockClient{}
+	s := NewServer(db, func(garmin.ClientConfig) garmin.Client { return m }, garmin.ClientConfig{}, garmin.SyncConfig{}, &authmock.Verifier{}, testSessionConfig)
 
 	rec := doJSON(t, s.Router(), http.MethodGet, "/api/activities/", nil) // "test-user" sub, never provisioned
 	if rec.Code != http.StatusForbidden {
@@ -196,7 +194,7 @@ func TestIsolation_GarminConnectedNeverLeaksAcrossUsers(t *testing.T) {
 	}
 
 	router := s.Router()
-	rec := doJSON(t, router, http.MethodPost, "/api/auth/login", nil) // as userA
+	rec := doJSON(t, router, http.MethodPost, "/api/garmin/auth/login", nil) // as userA
 	if rec.Code != http.StatusOK {
 		t.Fatalf("auth/login status = %d, body = %s", rec.Code, rec.Body.String())
 	}