api: scope activities, sync, review-queue, and reclassify handlers to userID

Completes the internal/api scoping pass -- the whole package now compiles
against the per-user store/sync/garmin signatures from Tasks 4-13. Also
fixes the test helpers (newTestServer now returns the provisioned userID)
and a latent bug in TestResolveUser_LeavesContextEmptyWhenNotProvisioned,
which relied on doJSON's hardcoded "test-user" session sub being
unprovisioned -- never caught before since internal/api couldn't compile
since Task 12.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/internal/api/setup_test.go

@@ -70,7 +70,7 @@ func TestSetup_RejectsEmptyDisplayName(t *testing.T) {
 }
 
 func TestSetup_RejectsWhenAlreadyProvisioned(t *testing.T) {
-	s, _ := newTestServer(t)
+	s, _, _ := newTestServer(t)
 	rec := doJSON(t, s.Router(), http.MethodPost, "/api/setup", map[string]any{"display_name": "Someone Else"})
 	if rec.Code != http.StatusConflict {
 		t.Fatalf("status = %d, want 409, body = %s", rec.Code, rec.Body.String())