feat(sync): 每小时后台自动同步 + 手动拉取最新接口

- services/scheduler.py：通过 job_locks 表跨 worker 抢占，
  gunicorn 多进程下一个周期只跑一次；claim 超时 30 分钟自动释放，
  避免 worker 中途挂掉把任务永久卡死
- POST /api/garmin/sync-latest：同步执行，窗口 clamp 到 1..7 天
- GET  /api/garmin/auto-sync：返回上次/下次运行时间
- db.py：注释里的分号会被 SCHEMA.split(";") 截断，改为先剥注释再切分

19 项调度器测试，全量 324 项通过

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

backend/app.py

@@ -12,6 +12,7 @@ from flask_cors import CORS
 import db
 from config import CORS_ORIGINS, PORT, STATIC_DIR
 from routes import auth, garmin, health, analysis
+from services import scheduler
 
 
 def create_app():
@@ -21,6 +22,11 @@ def create_app():
     # Create tables once at startup (idempotent).
     db.init_db()
 
+    # Keeps the database current without the user pressing anything. Safe to
+    # call in every worker: the job is claimed through the database, so only
+    # one of them actually runs a given tick.
+    scheduler.start()
+
     # In production the built React app is served by this same process, so the
     # deployment is a single port with no reverse proxy to configure. In
     # development STATIC_DIR does not exist and the CRA dev server serves the