feat(auth): 接入 auth-hub 统一登录，网页登录与 Garmin 同步彻底分离

网页身份改由 auth-hub 做 OAuth2 + PKCE 单点登录，本地邮箱/密码登录与注册整条链路删除
（routes/auth.py、auth.py 的密码哈希、config.py 的 ALLOW_REGISTRATION）。Garmin 账号绑定/
同步保持完全独立、可选：routes/garmin.py 不再直接查 users 表，Garmin 邮箱回退统一走新增
的 services/garmin.py::get_remembered_email()（优先读 garmin_tokens 当前绑定，兼容早期账号
落在 users.garmin_email 的历史值），彻底把「你是谁」和「你绑没绑 Garmin」两件事拆开。

- db.py: users 表新增 auth_hub_sub/auth_hub_username，MIGRATIONS 补上这两列（此前遗漏导致
  已存在的生产 MariaDB 表永远不会自动加列）；同时把历史遗留的 garmin_email/
  garmin_password_hash NOT NULL 约束在线迁移为可空，因为新账号不再在注册时收集这些字段。
- routes/auth.py: 修掉 /callback 路由重复拼接 /api/auth 前缀导致 404 的 bug。
- client: LoginPage 去掉本地登录/注册标签页，只保留 auth-hub 统一登录；登录成功/失败后都
  用 history.replaceState 清理地址栏，修掉 Framework7 browserHistory 读取
  /auth/callback?code=... 导致「找不到页面」的问题。
- 新增 test_auth_hub_client.py 锁定 find_or_create_user 按 auth_hub_sub 幂等——生产上曾经因为
  这个函数在没有该测试保护时被测试触发，误建过一个空账号，靠手工核对 health_data 计数才发现。
- 生产 auth-hub 侧另行为该项目注册了正式 client（未随本次提交变更，凭证只存在服务器 .env）。

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/routes/garmin.py

@@ -1,8 +1,16 @@
-"""Garmin routes: trigger a sync and read sync status."""
+"""Garmin routes: bind a Garmin account, trigger a sync, read sync status.
+
+Deliberately independent of the `users` identity: this blueprint reads and
+writes only `garmin_tokens` and the sync-status tables, keyed by `g.user_id`.
+Web login (routes/auth.py, via auth-hub) establishes who `g.user_id` is;
+whether that account has a Garmin binding at all is this blueprint's
+business alone, and the two are meant to be operable independently — see
+services/garmin.py's `get_remembered_email` for the one deliberate,
+backward-compatible read of the legacy `users.garmin_email` column.
+"""
 from flask import Blueprint, request, g, jsonify
 
 from auth import require_auth
-from db import query_one
 from services import garmin as garmin_svc
 from services import garmin_auth
 from services import scheduler
@@ -18,11 +26,9 @@ def sync():
         "garminEmail": (data.get("garminEmail") or "").strip(),
         "garminPassword": data.get("garminPassword") or "",
     }
-    # Fall back to the stored Garmin email when only a password is supplied.
+    # Fall back to the remembered Garmin email when only a password is supplied.
     if not creds["garminEmail"]:
-        user = query_one("SELECT garmin_email FROM users WHERE id = ?", [g.user_id])
-        if user and user.get("garmin_email"):
-            creds["garminEmail"] = user["garmin_email"]
+        creds["garminEmail"] = garmin_svc.get_remembered_email(g.user_id)
 
     # With stored OAuth tokens no password is needed at all. Without them the
     # plaintext password must come in the body, because only a hash is kept.
@@ -88,8 +94,7 @@ def login():
 
     garmin_email = (data.get("garminEmail") or "").strip()
     if not garmin_email:
-        user = query_one("SELECT garmin_email FROM users WHERE id = ?", [g.user_id])
-        garmin_email = (user or {}).get("garmin_email") or ""
+        garmin_email = garmin_svc.get_remembered_email(g.user_id)
     if not garmin_email:
         return jsonify({"error": "缺少 Garmin 邮箱"}), 400