refactor: merge internal/sync into internal/garmin, regroup api files and routes

Garmin auth/sync routes move under /api/garmin/*; sync.Service becomes
garmin.Sync with garmin.SyncConfig/ClientConfig; applog becomes
internal/log; the test mock moves into the garmin package as MockClient
(breaking the test-only import cycle the merge created); stale test
URLs and type names updated to match.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/internal/api/user_test.go

@@ -0,0 +1,66 @@
+package api
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"path/filepath"
+	"testing"
+
+	"geniusrun/backend/internal/auth"
+	authmock "geniusrun/backend/internal/auth/mock"
+	"geniusrun/backend/internal/garmin"
+	"geniusrun/backend/internal/store"
+)
+
+func TestResolveUser_AttachesResolvedUserWhenProvisioned(t *testing.T) {
+	s, _, userID := newTestServer(t)
+
+	var gotUserID int64
+	var gotOK bool
+	handler := auth.RequireSession(testSessionConfig.Secret)(s.resolveUser(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		u, ok := userFromContext(r.Context())
+		gotUserID, gotOK = u.ID, ok
+	})))
+
+	rec := doJSON(t, handler, http.MethodGet, "/", nil) // doJSON's test cookie carries Sub: "test-user"
+	_ = rec
+	if !gotOK || gotUserID != userID {
+		t.Fatalf("resolveUser: ok=%v userID=%d, want ok=true userID=%d", gotOK, gotUserID, userID)
+	}
+}
+
+func TestResolveUser_LeavesContextEmptyWhenNotProvisioned(t *testing.T) {
+	// Deliberately not newTestServer(t): that helper auto-provisions the
+	// "test-user" sub that doJSON's cookie always carries, which would
+	// defeat the point of this test. Build a server against a bare DB
+	// instead, same pattern as setup_test.go's unprovisioned-session tests.
+	db, err := store.Open(filepath.Join(t.TempDir(), "geniusrun_test.db"))
+	if err != nil {
+		t.Fatalf("store.Open: %v", err)
+	}
+	t.Cleanup(func() { db.Close() })
+	m := &garmin.MockClient{}
+	s := NewServer(db, func(garmin.ClientConfig) garmin.Client { return m }, garmin.ClientConfig{}, garmin.SyncConfig{}, &authmock.Verifier{}, testSessionConfig)
+
+	var gotOK bool
+	handler := auth.RequireSession(testSessionConfig.Secret)(s.resolveUser(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, gotOK = userFromContext(r.Context())
+	})))
+
+	doJSON(t, handler, http.MethodGet, "/", nil) // "test-user" sub, never provisioned in this test
+	if gotOK {
+		t.Fatal("expected userFromContext to report not-found for an unprovisioned sub")
+	}
+}
+
+func TestRequireProvisionedUser_RejectsWhenNoUserResolved(t *testing.T) {
+	handler := requireProvisionedUser(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		t.Fatal("handler should not be reached")
+	}))
+	req := httptest.NewRequest(http.MethodGet, "/", nil)
+	rec := httptest.NewRecorder()
+	handler.ServeHTTP(rec, req)
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("status = %d, want 403", rec.Code)
+	}
+}