feat(auth): 接入 auth-hub 统一登录，网页登录与 Garmin 同步彻底分离

网页身份改由 auth-hub 做 OAuth2 + PKCE 单点登录，本地邮箱/密码登录与注册整条链路删除
（routes/auth.py、auth.py 的密码哈希、config.py 的 ALLOW_REGISTRATION）。Garmin 账号绑定/
同步保持完全独立、可选：routes/garmin.py 不再直接查 users 表，Garmin 邮箱回退统一走新增
的 services/garmin.py::get_remembered_email()（优先读 garmin_tokens 当前绑定，兼容早期账号
落在 users.garmin_email 的历史值），彻底把「你是谁」和「你绑没绑 Garmin」两件事拆开。

- db.py: users 表新增 auth_hub_sub/auth_hub_username，MIGRATIONS 补上这两列（此前遗漏导致
  已存在的生产 MariaDB 表永远不会自动加列）；同时把历史遗留的 garmin_email/
  garmin_password_hash NOT NULL 约束在线迁移为可空，因为新账号不再在注册时收集这些字段。
- routes/auth.py: 修掉 /callback 路由重复拼接 /api/auth 前缀导致 404 的 bug。
- client: LoginPage 去掉本地登录/注册标签页，只保留 auth-hub 统一登录；登录成功/失败后都
  用 history.replaceState 清理地址栏，修掉 Framework7 browserHistory 读取
  /auth/callback?code=... 导致「找不到页面」的问题。
- 新增 test_auth_hub_client.py 锁定 find_or_create_user 按 auth_hub_sub 幂等——生产上曾经因为
  这个函数在没有该测试保护时被测试触发，误建过一个空账号，靠手工核对 health_data 计数才发现。
- 生产 auth-hub 侧另行为该项目注册了正式 client（未随本次提交变更，凭证只存在服务器 .env）。

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/db.py

@@ -33,10 +33,12 @@ from config import (
 SCHEMA = """
 CREATE TABLE IF NOT EXISTS users (
   id VARCHAR(64) PRIMARY KEY,
-  email VARCHAR(255) NOT NULL UNIQUE,
-  garmin_email VARCHAR(255) NOT NULL,
-  garmin_password_hash TEXT NOT NULL,
+  email VARCHAR(255) UNIQUE,
+  garmin_email VARCHAR(255),
+  garmin_password_hash TEXT,
   jwt_token TEXT,
+  auth_hub_sub VARCHAR(64) UNIQUE,
+  auth_hub_username VARCHAR(255),
   created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
   updated_at DATETIME DEFAULT CURRENT_TIMESTAMP
 );
@@ -413,6 +415,11 @@ def _row_to_dict(row):
 # nothing to a table that already exists, so new metrics need an explicit
 # additive migration or they silently never appear in production.
 MIGRATIONS = {
+    "users": [
+        # auth-hub SSO account linkage (local email/password login was removed).
+        ("auth_hub_sub", "VARCHAR(64)"),
+        ("auth_hub_username", "VARCHAR(255)"),
+    ],
     "sync_status": [
         # A full backfill runs for many minutes, so the UI needs to show how
         # far along it is rather than an indefinite spinner.
@@ -509,6 +516,28 @@ def _migrate(cur):
                 if "duplicate column" not in str(e).lower():
                     raise
 
+    # Accounts used to require a Garmin email/password at signup, so
+    # deployments from before auth-hub still have NOT NULL on these columns.
+    # New accounts come from auth-hub and bind Garmin credentials later (or
+    # never), so an install that predates that change needs its constraint
+    # relaxed once. `CREATE TABLE IF NOT EXISTS` cannot do this — it only
+    # applies to a table that does not exist yet — and SQLite has no
+    # `MODIFY COLUMN`, but every SQLite install is fresh enough to already
+    # have the nullable definition from SCHEMA above, so this only matters
+    # for MariaDB.
+    if DB_TYPE == "mariadb":
+        cur.execute(
+            "SELECT COLUMN_NAME FROM information_schema.COLUMNS "
+            "WHERE TABLE_SCHEMA = DATABASE() AND TABLE_NAME = 'users' "
+            "AND COLUMN_NAME IN ('garmin_email', 'garmin_password_hash') "
+            "AND IS_NULLABLE = 'NO'"
+        )
+        still_required = {r["COLUMN_NAME"] if isinstance(r, dict) else r[0] for r in cur.fetchall()}
+        if "garmin_email" in still_required:
+            cur.execute("ALTER TABLE users MODIFY COLUMN garmin_email VARCHAR(255) NULL")
+        if "garmin_password_hash" in still_required:
+            cur.execute("ALTER TABLE users MODIFY COLUMN garmin_password_hash TEXT NULL")
+
 
 # --- Public API -------------------------------------------------------------
 def _statements(schema):