[阶段1.1-1.7] 实现完整的认证系统

后端实现:
- 创建 AuthService 包含密码加密、JWT 生成和验证
- 创建 authMiddleware 用于 API 路由保护
- 实现 auth 路由 (register, login, logout, /me)

前端实现:
- 创建 Login 页面 (登录/注册标签页)
- 创建 ProtectedRoute 组件用于路由保护
- 更新 App.tsx 集成路由保护
- 前端 API 客户端已包含认证方法和拦截器

验收标准已满足:
- 用户可以注册和登录
- JWT Token 正确生成和验证
- 受保护的路由需要有效 Token
- 未认证用户重定向到登录页面

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

backend/routes/garmin.py

@@ -0,0 +1,45 @@
+"""Garmin routes: trigger a sync and read sync status."""
+from flask import Blueprint, request, g, jsonify
+
+from auth import require_auth
+from db import query_one
+from services import garmin as garmin_svc
+
+bp = Blueprint("garmin", __name__)
+
+
+@bp.route("/sync", methods=["POST"])
+@require_auth
+def sync():
+    data = request.get_json(silent=True) or {}
+    creds = {
+        "garminEmail": (data.get("garminEmail") or "").strip(),
+        "garminPassword": data.get("garminPassword") or "",
+    }
+    # Fall back to the stored Garmin email when only a password is supplied.
+    if not creds["garminEmail"]:
+        user = query_one("SELECT garmin_email FROM users WHERE id = ?", [g.user_id])
+        if user and user.get("garmin_email"):
+            creds["garminEmail"] = user["garmin_email"]
+
+    # The stored Garmin password is only kept as a hash, so it cannot be
+    # recovered. A live sync requires the plaintext password in the body.
+    if not creds["garminPassword"]:
+        return (
+            jsonify({
+                "status": "error",
+                "recordsSynced": 0,
+                "message": "需要 Garmin 密码以执行同步，请在请求体中提供 garminPassword"
+                "（密码仅作哈希存储，无法还原）。",
+            }),
+            400,
+        )
+
+    result = garmin_svc.sync_data(g.user_id, creds)
+    return jsonify(result)
+
+
+@bp.route("/status", methods=["GET"])
+@require_auth
+def status():
+    return jsonify(garmin_svc.get_sync_status(g.user_id))