feat: NAS 部署 + auth-hub 认证 + 同步逻辑修复

部署:
- 后端 Python/Flask，数据层可插拔 SQLite/MariaDB
- NAS 部署路径 /volume1/web/garmin-health-lab，端口 8124
- Gunicorn 生产服务器 (2 workers / 4 threads)
- 开机自启脚本 deploy/S99garmin.sh
- frp 隧道甲骨文 8124 → NAS 8124，外网访问
- 前端构建产物纳入版本管理 (backend/static/)

认证:
- auth-hub OAuth2/OIDC 统一登录接入
- 新建 NAS 专用 client，注册内外网回调地址
- 前端 LoginPage 支持回调路由 /auth/callback
- 数据同步页增加 Garmin 邮箱输入框

同步逻辑修复:
- 自动同步调度器读取用户 history_days 设置，不再固定 2 天
- 前端 0（全部历史）不再被 || 吞掉，改为 ?? 处理
- 后端路由和 sync_data 中 0 不再被当成 falsy 回退默认值
- sync_data 和调度器中 0 → 730 天（全部历史=最大范围）
- 已同步天数显示数据库实际总天数 (totalDays)
- 历史范围新增「自上次同步」增量选项 (days=-1)
- 后端 settings.py HISTORY 添加 -1 值

项目文档:
- 创建 PROGRESS.md 跟踪项目进度

backend/services/scheduler.py

@@ -127,8 +127,11 @@ def sync_all_accounts(days=None, respect_schedule=False):
     `respect_schedule` is what the background loop passes: it skips accounts
     that have auto-sync off or that were synced recently enough. A direct call
     (a manual "sync everything") leaves it False and syncs unconditionally.
+
+    When `days` is not provided, each account's saved `history_days` from
+    `user_settings` is used (the user's 历史范围 picker), falling back to
+    `SYNC_DAYS`.
     """
-    days = days or SYNC_DAYS
     rows = query_all("SELECT user_id FROM garmin_tokens")
     results = []
     for row in rows:
@@ -144,6 +147,16 @@ def sync_all_accounts(days=None, respect_schedule=False):
                     results.append({"user": uid, "status": "skipped",
                                     "reason": "not due"})
                     continue
+            # Resolve the sync window: prefer the user's saved history_days,
+            # then the caller override, then the global default.
+            if days is None:
+                s = query_one("SELECT history_days FROM user_settings WHERE user_id = ?", (uid,))
+                user_days = s[0] if s and s[0] is not None else None
+                if user_days == 0:
+                    user_days = 730  # 全部历史 → 最大范围
+                d = user_days if user_days is not None else SYNC_DAYS
+            else:
+                d = days
             # Never poke Garmin while it is rate-limiting us — that is exactly
             # what keeps the limit alive. Respect the persisted cooldown and sit
             # this tick out.
@@ -154,7 +167,7 @@ def sync_all_accounts(days=None, respect_schedule=False):
                     "retryAfterSeconds": int((blocked - _now()).total_seconds()),
                 })
                 continue
-            out = garmin_svc.sync_data(uid, {}, days=days)
+            out = garmin_svc.sync_data(uid, {}, days=d)
             results.append({"user": uid, "status": out.get("status"),
                             "records": out.get("recordsSynced")})
         except Exception as e:  # noqa: BLE001 - one account must not stop the rest