feat: NAS 部署 + auth-hub 认证 + 同步逻辑修复

部署:
- 后端 Python/Flask，数据层可插拔 SQLite/MariaDB
- NAS 部署路径 /volume1/web/garmin-health-lab，端口 8124
- Gunicorn 生产服务器 (2 workers / 4 threads)
- 开机自启脚本 deploy/S99garmin.sh
- frp 隧道甲骨文 8124 → NAS 8124，外网访问
- 前端构建产物纳入版本管理 (backend/static/)

认证:
- auth-hub OAuth2/OIDC 统一登录接入
- 新建 NAS 专用 client，注册内外网回调地址
- 前端 LoginPage 支持回调路由 /auth/callback
- 数据同步页增加 Garmin 邮箱输入框

同步逻辑修复:
- 自动同步调度器读取用户 history_days 设置，不再固定 2 天
- 前端 0（全部历史）不再被 || 吞掉，改为 ?? 处理
- 后端路由和 sync_data 中 0 不再被当成 falsy 回退默认值
- sync_data 和调度器中 0 → 730 天（全部历史=最大范围）
- 已同步天数显示数据库实际总天数 (totalDays)
- 历史范围新增「自上次同步」增量选项 (days=-1)
- 后端 settings.py HISTORY 添加 -1 值

项目文档:
- 创建 PROGRESS.md 跟踪项目进度

deploy/S99garmin.sh

@@ -1,7 +1,7 @@
 #!/bin/sh
 # Garmin Health Lab — DSM boot script.
 # Mirrors the convention already used by S99frpc.sh on this NAS.
-APP=/var/services/homes/ericwyuan/apps/garmin-health-lab
+APP=/volume1/web/garmin-health-lab
 RUNAS=ericwyuan
 # Kept inside the app dir, not /var/run: the service runs as an unprivileged
 # user, which cannot write there.
@@ -17,9 +17,9 @@ start() {
   # setsid + closed stdio so it survives the invoking shell and never holds
   # an SSH session open.
   if [ "$(id -un)" = "$RUNAS" ]; then
-    sh "$APP/start.sh" >/dev/null 2>&1 </dev/null
+    sh "$APP/deploy/start.sh" >/dev/null 2>&1 </dev/null
   else
-    su - "$RUNAS" -c "sh $APP/start.sh" >/dev/null 2>&1 </dev/null
+    su - "$RUNAS" -c "sh $APP/deploy/start.sh" >/dev/null 2>&1 </dev/null
   fi
   sleep 2
   echo "started (pid $(cat "$PIDFILE" 2>/dev/null))"
@@ -28,7 +28,7 @@ start() {
 stop() {
   [ -f "$PIDFILE" ] && kill "$(cat "$PIDFILE")" 2>/dev/null
   rm -f "$PIDFILE"
-  pkill -f "gunicorn.*8123" 2>/dev/null
+  pkill -f "gunicorn.*8124" 2>/dev/null
   echo "stopped"
 }
 
@@ -43,4 +43,4 @@ case "$1" in
       echo "not running"
     fi ;;
   *) echo "Usage: $0 {start|stop|restart|status}" ;;
-esac
+esac

deploy/start.sh

@@ -1,16 +1,16 @@
 #!/bin/sh
 # Start Garmin Health Lab. Safe to run repeatedly: an already-running
 # instance is stopped first. Intended for DSM Task Scheduler (boot-up).
-APP="$(cd "$(dirname "$0")" && pwd)"
+APP="$(cd "$(dirname "$0")/.." && pwd)"
 cd "$APP/backend" || exit 1
 
 GUNICORN="$APP/backend/.venv/bin/gunicorn"
 
 # Stop whatever is already running, then WAIT for the port to actually be
-# free. Killing only the pid in app.pid left orphaned workers holding :8123;
+# free. Killing only the pid in app.pid left orphaned workers holding :8124;
 # the new master then started, reported success, and served nothing — the
 # site was down while every log line looked normal.
-"$APP/stop.sh" >/dev/null 2>&1
+"$APP/deploy/stop.sh" >/dev/null 2>&1
 i=0
 while [ $i -lt 20 ]; do
   pgrep -f "$GUNICORN" >/dev/null 2>&1 || break
@@ -25,7 +25,7 @@ mkdir -p "$APP/logs"
 # minutes, and gunicorn kills a worker that looks stuck before then.
 nohup "$GUNICORN" \
   --workers 2 --threads 4 --timeout 300 \
-  --bind 0.0.0.0:8123 \
+  --bind 0.0.0.0:8124 \
   --access-logfile "$APP/logs/access.log" \
   --error-logfile "$APP/logs/error.log" \
   wsgi:app > "$APP/logs/stdout.log" 2>&1 &
@@ -35,13 +35,13 @@ echo $! > "$APP/app.pid"
 # Confirm it is actually serving rather than just running.
 i=0
 while [ $i -lt 25 ]; do
-  if curl -sf -m 2 -o /dev/null http://127.0.0.1:8123/api/health/status; then
-    echo "started pid $(cat "$APP/app.pid") on :8123"
+  if curl -sf -m 2 -o /dev/null http://127.0.0.1:8124/api/health/status; then
+    echo "started pid $(cat "$APP/app.pid") on :8124"
     exit 0
   fi
   sleep 1
   i=$((i + 1))
 done
 
-echo "FAILED to serve on :8123 — see $APP/logs/error.log" >&2
-exit 1
+echo "FAILED to serve on :8124 — see $APP/logs/error.log" >&2
+exit 1

deploy/stop.sh

@@ -1,5 +1,5 @@
 #!/bin/sh
-APP="$(cd "$(dirname "$0")" && pwd)"
+APP="$(cd "$(dirname "$0")/.." && pwd)"
 GUNICORN="$APP/backend/.venv/bin/gunicorn"
 
 if [ -f "$APP/app.pid" ]; then
@@ -8,7 +8,7 @@ if [ -f "$APP/app.pid" ]; then
 fi
 
 # The master's workers do not always go with it, and a surviving worker keeps
-# :8123 bound — which looks exactly like a healthy start that serves nothing.
+# :8124 bound — which looks exactly like a healthy start that serves nothing.
 i=0
 while [ $i -lt 15 ]; do
   pgrep -f "$GUNICORN" >/dev/null 2>&1 || exit 0
@@ -16,4 +16,4 @@ while [ $i -lt 15 ]; do
   i=$((i + 1))
 done
 pkill -9 -f "$GUNICORN" 2>/dev/null
-echo "force-stopped leftover workers"
+echo "force-stopped leftover workers"