refactor: merge internal/sync into internal/garmin, regroup api files and routes

Garmin auth/sync routes move under /api/garmin/*; sync.Service becomes
garmin.Sync with garmin.SyncConfig/ClientConfig; applog becomes
internal/log; the test mock moves into the garmin package as MockClient
(breaking the test-only import cycle the merge created); stale test
URLs and type names updated to match.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/superpowers/plans/2026-07-25-per-user-profile.md

@@ -2223,14 +2223,14 @@ EOF
 ## Task 10: `internal/sync.Service` becomes per-user
 
 **Files:**
-- Modify: `backend/internal/sync/service.go`
-- Modify: `backend/internal/sync/service_test.go`
+- Modify: `../../../backend/internal/garmin/sync.go`
+- Modify: `../../../backend/internal/garmin/sync_test.go`
 
 **Interfaces:**
 - Consumes: every scoped store method from Tasks 4-8.
 - Produces: `func NewService(g garmin.Client, db *store.DB, userID int64, cfg Config, now func() time.Time) *Service`. Every other `Service` method (`Backfill`, `IncrementalSync`, `FullSync`, `ResetAll`, `FillPendingDetails`, `ClassifyActivity`, `Progress`) keeps its exact current signature — the userID is baked into the `Service` instance at construction (one `Service` per logged-in user, per the design), so callers in `internal/api` (Tasks 13/15) never pass a userID to these methods directly, only to `NewService` itself.
 
-- [ ] **Step 1: Add the `userID` field and thread it through every store call in `backend/internal/sync/service.go`**
+- [ ] **Step 1: Add the `userID` field and thread it through every store call in `../../../backend/internal/garmin/sync.go`**
 
 Change the `Service` struct and `NewService`:
 
@@ -2269,7 +2269,7 @@ Then, in every remaining method, prefix `s.userID` as the new argument to every
 - `fillActivityDetails`: `s.db.SetActivityWorkout(ctx, a.ID, ...)` → `s.db.SetActivityWorkout(ctx, s.userID, a.ID, ...)`; `s.db.ReplaceActivitySamples(ctx, a.ID, ...)` → `s.db.ReplaceActivitySamples(ctx, s.userID, a.ID, ...)`; `s.db.ReplaceLaps(ctx, a.ID, ...)` → `s.db.ReplaceLaps(ctx, s.userID, a.ID, ...)`; `s.db.SetActivityDetails(ctx, a.ID, ...)` → `s.db.SetActivityDetails(ctx, s.userID, a.ID, ...)`; `s.db.SetActivitySplitsFetched(ctx, a.ID)` → `s.db.SetActivitySplitsFetched(ctx, s.userID, a.ID)`.
 - `ClassifyActivity`: `s.db.GetActivity(ctx, activityID)` → `s.db.GetActivity(ctx, s.userID, activityID)`; `s.db.LapsForActivity(ctx, activityID)` → `s.db.LapsForActivity(ctx, s.userID, activityID)`; `s.db.ListWorkoutKinds(ctx, true)` → `s.db.ListWorkoutKinds(ctx, s.userID, true)`; `s.db.GetProfile(ctx)` → `s.db.GetProfile(ctx, s.userID)`; `s.db.InsertKindAssignment(ctx, store.KindAssignment{...})` → `s.db.InsertKindAssignment(ctx, s.userID, store.KindAssignment{...})`.
 
-- [ ] **Step 2: Fix `backend/internal/sync/service_test.go`'s `NewService` calls**
+- [ ] **Step 2: Fix `../../../backend/internal/garmin/sync_test.go`'s `NewService` calls**
 
 Every `NewService(m, db, Config{...}, fixedNow(...))` call in this file needs a `userID` inserted as the third argument. Add a shared helper near the top of the file (next to `openTestDB`/`fixedNow`):
 
@@ -2355,7 +2355,7 @@ Run: `cd backend && gofmt -l internal/sync/`
 Expected: no output.
 
 ```bash
-git add backend/internal/sync/service.go backend/internal/sync/service_test.go
+git add backend/internal/sync/sync.go backend/internal/sync/sync_test.go
 git commit -m "$(cat <<'EOF'
 sync: scope Service to one user per instance
 
@@ -2372,12 +2372,12 @@ EOF
 ## Task 11: `internal/config` additions
 
 **Files:**
-- Modify: `backend/internal/config/config.go`
+- Modify: `../../../backend/internal/config/envconfig.go`
 
 **Interfaces:**
 - Produces: `Config.GarminTokenStoreRoot` (renamed from `GarminTokenStore`, same env var `GARMIN_TOKENSTORE`, now holds a root directory rather than a single path); `Config.LegacyOwnerOIDCSub` (new, optional, env var `GENIUSRUN_LEGACY_OWNER_OIDC_SUB`). Task 13's `main.go` wiring consumes both.
 
-- [ ] **Step 1: Rename `GarminTokenStore` → `GarminTokenStoreRoot` and add `LegacyOwnerOIDCSub`**
+- [ ] **Step 1: Rename `GarminTokenStore` → `TokenStoreRoot` and add `LegacyOwnerOIDCSub`**
 
 In the `Config` struct, change:
 
@@ -2427,7 +2427,7 @@ Run: `cd backend && gofmt -l internal/config/`
 Expected: no output.
 
 ```bash
-git add backend/internal/config/config.go
+git add backend/internal/config/envconfig.go
 git commit -m "$(cat <<'EOF'
 config: add per-user Garmin token store root and legacy-owner bootstrap var
 
@@ -2442,17 +2442,17 @@ EOF
 ## Task 12: User-resolution middleware + `POST /api/setup`
 
 **Files:**
-- Create: `backend/internal/api/usercontext.go`
+- Create: `../../../backend/internal/api/user.go`
 - Create: `backend/internal/api/setup.go`
 - Modify: `backend/internal/api/session.go` (extend `sessionMeResponse`, `handleSessionMe`)
-- Create: `backend/internal/api/usercontext_test.go`
+- Create: `../../../backend/internal/api/user_test.go`
 - Create: `backend/internal/api/setup_test.go`
 
 **Interfaces:**
 - Consumes: `store.GetUserBySub`/`store.ProvisionUser` (Task 2), `auth.ClaimsFromContext` (existing).
 - Produces: `func (s *Server) resolveUser(next http.Handler) http.Handler` (middleware); `func requireProvisionedUser(next http.Handler) http.Handler` (middleware); `func userFromContext(ctx context.Context) (resolvedUser, bool)`; `func userIDFromContext(ctx context.Context) int64`; `func (s *Server) handleSetup(w http.ResponseWriter, r *http.Request)`. Task 13 wires all of these into the router; every handler task (14/15) calls `userIDFromContext`.
 
-- [ ] **Step 1: Write the failing tests in `backend/internal/api/usercontext_test.go`**
+- [ ] **Step 1: Write the failing tests in `../../../backend/internal/api/user_test.go`**
 
 Since `auth`'s session context key is unexported, this test drives the real chain (`auth.RequireSession` then `s.resolveUser`) via a minted session cookie — the same `doJSON` helper `api_test.go` already uses for every other handler test — rather than trying to poke the context directly.
 
@@ -2521,7 +2521,7 @@ func TestRequireProvisionedUser_RejectsWhenNoUserResolved(t *testing.T) {
 Run: `cd backend && go vet ./internal/api/...`
 Expected: FAIL — `s.resolveUser`/`userFromContext`/`requireProvisionedUser` undefined.
 
-- [ ] **Step 3: Write `backend/internal/api/usercontext.go`**
+- [ ] **Step 3: Write `../../../backend/internal/api/user.go`**
 
 ```go
 package api
@@ -2790,7 +2790,7 @@ Run: `cd backend && gofmt -l internal/api/`
 Expected: no output.
 
 ```bash
-git add backend/internal/api/usercontext.go backend/internal/api/usercontext_test.go backend/internal/api/setup.go backend/internal/api/setup_test.go backend/internal/api/session.go backend/internal/api/server.go
+git add backend/internal/api/user.go backend/internal/api/user_test.go backend/internal/api/setup.go backend/internal/api/setup_test.go backend/internal/api/session.go backend/internal/api/server.go
 git commit -m "$(cat <<'EOF'
 api: add user-resolution middleware and POST /api/setup
 
@@ -3302,7 +3302,7 @@ func TestSetup_RejectsEmptyDisplayName(t *testing.T) {
 - [ ] **Step 4: Build everything and fix remaining call sites**
 
 Run: `cd backend && go build ./... 2>&1 | head -50`
-Expected: remaining errors are all inside `internal/api/*.go` handler files (`profile.go`, `activities.go`, `sync.go`, `kinds.go`, `review.go`, `reclassify.go`, `progression.go`, `auth.go`) and `cmd/seedsample/main.go` — referencing `s.Garmin`/`s.Sync` (now removed) or store methods missing `userID`. These are fixed in Tasks 14/15/17; confirm no errors remain in `server.go`, `main.go`, or `api_test.go` itself.
+Expected: remaining errors are all inside `internal/api/*.go` handler files (`profile.go`, `activities.go`, `sync.go`, `kinds.go`, `review.go`, `reclassify.go`, `progression.go`, `garmin.go`) and `cmd/seedsample/main.go` — referencing `s.Garmin`/`s.Sync` (now removed) or store methods missing `userID`. These are fixed in Tasks 14/15/17; confirm no errors remain in `server.go`, `main.go`, or `api_test.go` itself.
 
 - [ ] **Step 5: `gofmt` and commit**
 
@@ -3325,12 +3325,12 @@ EOF
 
 ---
 
-## Task 14: Thread `userID` into `profile.go`, `kinds.go`, `auth.go`, `progression.go`
+## Task 14: Thread `userID` into `profile.go`, `kinds.go`, `garmin.go`, `progression.go`
 
 **Files:**
 - Modify: `backend/internal/api/profile.go`
 - Modify: `backend/internal/api/kinds.go`
-- Modify: `backend/internal/api/auth.go`
+- Modify: `../../../backend/internal/api/garmin.go`
 - Modify: `backend/internal/api/progression.go`
 - Modify: `backend/internal/api/api_test.go` (no new call-site changes expected beyond what Task 13 already made — this task only touches handler bodies, not test bodies, since the HTTP-level test assertions are unchanged)
 
@@ -3508,7 +3508,7 @@ func (s *Server) handleUpdateWorkoutKind(w http.ResponseWriter, r *http.Request)
 }
 ```
 
-- [ ] **Step 3: Update `backend/internal/api/auth.go`**
+- [ ] **Step 3: Update `../../../backend/internal/api/garmin.go`**
 
 Keep `authResponse`, `authStatusString` unchanged; replace `recordAuthResult` and the three handlers:
 
@@ -3636,7 +3636,7 @@ Run: `cd backend && gofmt -l internal/api/`
 Expected: no output.
 
 ```bash
-git add backend/internal/api/profile.go backend/internal/api/kinds.go backend/internal/api/auth.go backend/internal/api/progression.go
+git add backend/internal/api/profile.go backend/internal/api/kinds.go backend/internal/api/garmin.go backend/internal/api/progression.go
 git commit -m "$(cat <<'EOF'
 api: scope profile, workout-kind, Garmin auth, and progression handlers to userID