fix(garmin): 重新绑定走的是同一个被封的登录接口，也得拦住

用户问：限流了，重新输账号密码验证码换个新令牌行不行。

不行，而且是最糟的一种试法。`garth.login()` 和 `refresh_oauth2()` 打的是
同一个 SSO 端点，流程还更重；限流按**账号**计（不是按 IP、按 UA），换设备
换网络都绕不开；而窗口内每次尝试都会把窗口往后推。

而这正是被卡住时第一个会去试的操作，代码里却只有 `_connect` 的刷新有闸门，
重新绑定那条路照发不误。

- start_login 在 sso 冷却窗口内直接拒绝，不建会话行、不碰网络
- 错误信息说清三件事：为什么现在不试、什么时候恢复、换设备没用
- 路由返 429（请求本身没毛病，是该晚点再来）并带 retryAfterSeconds
- 数据端点的 429 不参与拦截，force 可以推翻

前端补上 UI：报错文案早先承诺了「同步页选择强制重试」，但那个按钮不存在。
现在只在被冷却拒绝之后才出现，样式刻意做得不像第二个「开始同步」——它是给
估算失准时的出口，不是随手可点的第二选择。

顺带修一个正要被我引入的 bug：`onClick={syncHistory}` 会把 MouseEvent 当成
force 传进去，等于每次点开始同步都跳过冷却。

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/routes/garmin.py

@@ -115,7 +115,18 @@ def login():
     if not garmin_email:
         return jsonify({"error": "缺少 Garmin 邮箱"}), 400
 
-    session_id = garmin_auth.start_login(g.user_id, garmin_email, password)
+    try:
+        session_id = garmin_auth.start_login(
+            g.user_id, garmin_email, password, force=bool(data.get("force"))
+        )
+    except garmin_auth.LoginRateLimited as e:
+        # 429, not 400: the request was well-formed and the client should
+        # retry later — and the body says when, and why not now.
+        return jsonify({
+            "error": str(e),
+            "status": "rate_limited",
+            "retryAfterSeconds": garmin_auth.retry_after_seconds(g.user_id),
+        }), 429
     return jsonify({"session": session_id, "status": "starting"}), 202
 
 

backend/services/garmin_auth.py

@@ -129,8 +129,47 @@ def _run_login(session_id, user_id, garmin_email, password, is_cn, import_garmin
         _set(session_id, "failed", error=error, code=None)
 
 
-def start_login(user_id, garmin_email, password, import_garmin=None, is_cn=None):
-    """Kick off a login in the background. Returns the session id."""
+class LoginRateLimited(Exception):
+    """Refused before contacting Garmin, because a login 429 is still active."""
+
+
+def retry_after_seconds(user_id):
+    """Seconds until the login cooldown lapses, or None."""
+    blocked = garmin_svc.sso_cooldown(user_id)
+    if not blocked:
+        return None
+    return max(0, int((blocked - datetime.datetime.utcnow()).total_seconds()))
+
+
+def start_login(user_id, garmin_email, password, import_garmin=None,
+                is_cn=None, force=False):
+    """Kick off a login in the background. Returns the session id.
+
+    Refuses while a login 429 is still in its window. Re-binding is the
+    obvious thing to try when syncing is blocked — "just get a fresh token" —
+    but it goes through `garth.login()`, which is the *same* SSO endpoint that
+    is doing the blocking, by a heavier path than the token refresh. The limit
+    is keyed to the account, so a new password entry, a new device or a new
+    network reaches the same wall, and each attempt pushes the window out.
+
+    `force` overrules the recorded deadline, which is this app's own 24h guess
+    rather than anything Garmin stated.
+    """
+    if force:
+        garmin_svc.clear_rate_limit(user_id)
+    else:
+        blocked = garmin_svc.sso_cooldown(user_id)
+        if blocked:
+            minutes = int(
+                (blocked - datetime.datetime.utcnow()).total_seconds() // 60
+            )
+            raise LoginRateLimited(
+                "Garmin 正在限制该账号的登录请求。重新绑定走的是同一个登录接口，"
+                f"现在重试只会延长封锁。预计 {blocked.isoformat(timespec='minutes')} "
+                f"UTC 之后恢复（约 {minutes} 分钟）。"
+                "限流按账号计算，换设备或换网络都绕不开。"
+            )
+
     _cleanup(user_id)
 
     session_id = str(uuid.uuid4())

backend/tests/test_garmin_mfa.py

@@ -276,3 +276,52 @@ class TestEndpoints:
         assert wait_status(sid, "done", "failed") == "done"
         assert client.get("/api/garmin/auth-status", headers=auth).get_json()[
             "hasToken"] is True
+
+
+class TestRebindingIsGatedToo:
+    """"Just re-enter the password and get a fresh token" is the obvious thing
+    to try when syncing is blocked — and it is the worst thing to try.
+
+    `garth.login()` is the same SSO endpoint that is doing the blocking, by a
+    heavier path than the token refresh, and the limit is keyed to the account
+    so a new device or network reaches the same wall.
+    """
+
+    def test_login_is_refused_inside_the_window(self, db, user):
+        garmin_svc._note_rate_limit(user["id"], "sso")
+        with pytest.raises(garmin_auth.LoginRateLimited):
+            garmin_auth.start_login(user["id"], "a@example.com", "pw")
+
+    def test_no_session_row_is_created_by_a_refusal(self, db, user):
+        garmin_svc._note_rate_limit(user["id"], "sso")
+        with pytest.raises(garmin_auth.LoginRateLimited):
+            garmin_auth.start_login(user["id"], "a@example.com", "pw")
+        rows = db.query_all(
+            "SELECT id FROM garmin_mfa_sessions WHERE user_id = ?", [user["id"]])
+        assert rows == []
+
+    def test_a_data_429_does_not_block_rebinding(self, db, user, monkeypatch):
+        started = []
+        monkeypatch.setattr(garmin_auth.threading, "Thread",
+                            lambda **kw: type("T", (), {"start": lambda s: started.append(1)})())
+        garmin_svc._note_rate_limit(user["id"], "data")
+        garmin_auth.start_login(user["id"], "a@example.com", "pw")
+        assert started == [1]
+
+    def test_force_overrules_the_estimate(self, db, user, monkeypatch):
+        started = []
+        monkeypatch.setattr(garmin_auth.threading, "Thread",
+                            lambda **kw: type("T", (), {"start": lambda s: started.append(1)})())
+        garmin_svc._note_rate_limit(user["id"], "sso")
+        garmin_auth.start_login(user["id"], "a@example.com", "pw", force=True)
+        assert started == [1]
+
+    def test_the_endpoint_answers_429_with_a_retry_hint(self, client, auth, db, user):
+        garmin_svc._note_rate_limit(user["id"], "sso")
+        resp = client.post("/api/garmin/login",
+                           json={"garminPassword": "pw", "garminEmail": "a@example.com"},
+                           headers=auth)
+        assert resp.status_code == 429
+        body = resp.get_json()
+        assert body["retryAfterSeconds"] > 0
+        assert "延长封锁" in body["error"]