refactor: merge internal/sync into internal/garmin, regroup api files and routes

Garmin auth/sync routes move under /api/garmin/*; sync.Service becomes
garmin.Sync with garmin.SyncConfig/ClientConfig; applog becomes
internal/log; the test mock moves into the garmin package as MockClient
(breaking the test-only import cycle the merge created); stale test
URLs and type names updated to match.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/internal/config/envconfig_test.go

@@ -0,0 +1,194 @@
+package config
+
+import (
+	"testing"
+)
+
+func setRequiredEnv(t *testing.T) {
+	t.Helper()
+	t.Setenv("GENIUSRUN_BACKEND_URL", "https://geniusrun.example.com")
+	t.Setenv("GENIUSRUN_OIDC_ISSUER_URL", "https://keycloak.example.com/realms/myrealm")
+	t.Setenv("GENIUSRUN_OIDC_CLIENT_ID", "geniusrun")
+	t.Setenv("GENIUSRUN_OIDC_CLIENT_SECRET", "client-secret")
+	t.Setenv("GENIUSRUN_SESSION_SECRET", "a-session-secret-that-is-at-least-32-bytes-long")
+}
+
+func TestLoad_DerivesOIDCSettingsFromBackendURL(t *testing.T) {
+	setRequiredEnv(t)
+
+	cfg, err := LoadEnv()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.OIDCRedirectURL != "https://geniusrun.example.com/api/session/callback" {
+		t.Errorf("OIDCRedirectURL = %q", cfg.OIDCRedirectURL)
+	}
+	if !cfg.SessionSecure {
+		t.Error("SessionSecure = false, want true for an https base URL")
+	}
+	if cfg.OIDCRequiredRole != "geniusrun-user" {
+		t.Errorf("OIDCRequiredRole = %q, want default", cfg.OIDCRequiredRole)
+	}
+}
+
+func TestLoad_HTTPBaseURLYieldsInsecureCookies(t *testing.T) {
+	setRequiredEnv(t)
+	t.Setenv("GENIUSRUN_BACKEND_URL", "http://localhost:8080")
+
+	cfg, err := LoadEnv()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.SessionSecure {
+		t.Error("SessionSecure = true, want false for an http base URL")
+	}
+	if cfg.OIDCRedirectURL != "http://localhost:8080/api/session/callback" {
+		t.Errorf("OIDCRedirectURL = %q", cfg.OIDCRedirectURL)
+	}
+}
+
+func TestLoad_MissingRequiredOIDCVars(t *testing.T) {
+	cases := []string{
+		"GENIUSRUN_BACKEND_URL",
+		"GENIUSRUN_OIDC_ISSUER_URL",
+		"GENIUSRUN_OIDC_CLIENT_ID",
+		"GENIUSRUN_OIDC_CLIENT_SECRET",
+	}
+	for _, missing := range cases {
+		t.Run(missing, func(t *testing.T) {
+			setRequiredEnv(t)
+			t.Setenv(missing, "")
+			if _, err := LoadEnv(); err == nil {
+				t.Fatalf("expected error when %s is unset", missing)
+			}
+		})
+	}
+}
+
+func TestLoad_SessionSecretTooShort(t *testing.T) {
+	setRequiredEnv(t)
+	t.Setenv("GENIUSRUN_SESSION_SECRET", "too-short")
+
+	if _, err := LoadEnv(); err == nil {
+		t.Fatal("expected error for a session secret under 32 characters")
+	}
+}
+
+func TestLoad_GarminTokenStoreRootDefaultsIndependentlyOfDBPath(t *testing.T) {
+	setRequiredEnv(t)
+	t.Setenv("GENIUSRUN_TOKENSTORE_PATH", "")
+	t.Setenv("GENIUSRUN_DB_PATH", "/var/lib/geniusrun/geniusrun.db")
+
+	cfg, err := LoadEnv()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.TokenStoreRoot != ".garmin" {
+		t.Errorf("GarminTokenStoreRoot = %q, want %q (never derived from DBPath's directory)", cfg.TokenStoreRoot, ".garmin")
+	}
+}
+
+func TestLoad_GarminTokenStoreRootExplicitOverridesDefault(t *testing.T) {
+	setRequiredEnv(t)
+	t.Setenv("GENIUSRUN_TOKENSTORE_PATH", "/custom/tokenstores")
+	t.Setenv("GENIUSRUN_DB_PATH", "/var/lib/geniusrun/geniusrun.db")
+
+	cfg, err := LoadEnv()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.TokenStoreRoot != "/custom/tokenstores" {
+		t.Errorf("GarminTokenStoreRoot = %q, want explicit override to take precedence", cfg.TokenStoreRoot)
+	}
+}
+
+func TestLoad_LogLevelDefaultsToInfo(t *testing.T) {
+	setRequiredEnv(t)
+	t.Setenv("GENIUSRUN_LOG_LEVEL", "")
+
+	cfg, err := LoadEnv()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.LogLevel != "info" {
+		t.Errorf("LogLevel = %q, want default %q", cfg.LogLevel, "info")
+	}
+}
+
+func TestLoad_LogLevelExplicitOverridesDefault(t *testing.T) {
+	setRequiredEnv(t)
+	t.Setenv("GENIUSRUN_LOG_LEVEL", "debug")
+
+	cfg, err := LoadEnv()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.LogLevel != "debug" {
+		t.Errorf("LogLevel = %q, want debug", cfg.LogLevel)
+	}
+}
+
+func TestLoad_GarminPythonPathDefaultsToPython3(t *testing.T) {
+	setRequiredEnv(t)
+	t.Setenv("GENIUSRUN_PYTHON_PATH", "")
+
+	cfg, err := LoadEnv()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.PythonPath != "python3" {
+		t.Errorf("GarminPythonPath = %q, want default %q", cfg.PythonPath, "python3")
+	}
+}
+
+func TestLoad_GarminPythonPathExplicitOverridesDefault(t *testing.T) {
+	setRequiredEnv(t)
+	t.Setenv("GENIUSRUN_PYTHON_PATH", "/opt/venv/bin/python3")
+
+	cfg, err := LoadEnv()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.PythonPath != "/opt/venv/bin/python3" {
+		t.Errorf("GarminPythonPath = %q, want explicit override", cfg.PythonPath)
+	}
+}
+
+func TestLoad_FrontendURLDefaultsToBackendURL(t *testing.T) {
+	setRequiredEnv(t)
+	t.Setenv("GENIUSRUN_FRONTEND_URL", "")
+
+	cfg, err := LoadEnv()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.FrontendURL != cfg.BackendURL {
+		t.Errorf("FrontendURL = %q, want it to default to BackendURL %q", cfg.FrontendURL, cfg.BackendURL)
+	}
+}
+
+func TestLoad_FrontendURLExplicitOverridesDefault(t *testing.T) {
+	setRequiredEnv(t)
+	t.Setenv("GENIUSRUN_FRONTEND_URL", "http://localhost:5173/")
+
+	cfg, err := LoadEnv()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.FrontendURL != "http://localhost:5173" {
+		t.Errorf("FrontendURL = %q, want http://localhost:5173 (trailing slash trimmed)", cfg.FrontendURL)
+	}
+}
+
+func TestLoad_CustomRole(t *testing.T) {
+	setRequiredEnv(t)
+	t.Setenv("GENIUSRUN_OIDC_REQUIRED_ROLE", "admin")
+
+	cfg, err := LoadEnv()
+	if err != nil {
+		t.Fatalf("Load: %v", err)
+	}
+	if cfg.OIDCRequiredRole != "admin" {
+		t.Errorf("OIDCRequiredRole = %q", cfg.OIDCRequiredRole)
+	}
+}