refactor: merge internal/sync into internal/garmin, regroup api files and routes

Garmin auth/sync routes move under /api/garmin/*; sync.Service becomes
garmin.Sync with garmin.SyncConfig/ClientConfig; applog becomes
internal/log; the test mock moves into the garmin package as MockClient
(breaking the test-only import cycle the merge created); stale test
URLs and type names updated to match.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/superpowers/plans/2026-07-26-profile-deletion.md

@@ -270,7 +270,7 @@ git commit -m "feat(store): add DeleteUser with cascading account deletion"
 ### Task 2: `DELETE /api/profile` and Garmin client/tokenstore teardown
 
 **Files:**
-- Modify: `backend/internal/api/server.go:5-21` (imports), `:95-117` (new `removeGarminClient` after `syncFor`), `:167-170` (route)
+- Modify: `backend/internal/api/server.go:5-21` (imports), `:95-117` (new `removeUserClient` after `syncFor`), `:167-170` (route)
 - Modify: `backend/internal/api/profile.go` (add `handleDeleteProfile`)
 - Modify: `backend/internal/api/api_test.go` (imports + 3 new tests)
 - Modify: `backend/internal/api/isolation_test.go` (1 new test)
@@ -427,7 +427,7 @@ func TestIsolation_DeleteProfileOnlyDeletesOwnAccount(t *testing.T) {
 Run: `cd backend && go test ./internal/api/... -run 'TestDeleteProfile|TestIsolation_DeleteProfile' -v`
 Expected: FAIL — 404s (no `DELETE /api/profile` route registered yet).
 
-- [ ] **Step 3: Add the `os` import and `removeGarminClient` to `server.go`**
+- [ ] **Step 3: Add the `os` import and `removeUserClient` to `server.go`**
 
 Change the import block (add `"os"` between `"net/http"` and `"path/filepath"`):