feat(auth): 接入 auth-hub 统一登录，网页登录与 Garmin 同步彻底分离

网页身份改由 auth-hub 做 OAuth2 + PKCE 单点登录，本地邮箱/密码登录与注册整条链路删除
（routes/auth.py、auth.py 的密码哈希、config.py 的 ALLOW_REGISTRATION）。Garmin 账号绑定/
同步保持完全独立、可选：routes/garmin.py 不再直接查 users 表，Garmin 邮箱回退统一走新增
的 services/garmin.py::get_remembered_email()（优先读 garmin_tokens 当前绑定，兼容早期账号
落在 users.garmin_email 的历史值），彻底把「你是谁」和「你绑没绑 Garmin」两件事拆开。

- db.py: users 表新增 auth_hub_sub/auth_hub_username，MIGRATIONS 补上这两列（此前遗漏导致
  已存在的生产 MariaDB 表永远不会自动加列）；同时把历史遗留的 garmin_email/
  garmin_password_hash NOT NULL 约束在线迁移为可空，因为新账号不再在注册时收集这些字段。
- routes/auth.py: 修掉 /callback 路由重复拼接 /api/auth 前缀导致 404 的 bug。
- client: LoginPage 去掉本地登录/注册标签页，只保留 auth-hub 统一登录；登录成功/失败后都
  用 history.replaceState 清理地址栏，修掉 Framework7 browserHistory 读取
  /auth/callback?code=... 导致「找不到页面」的问题。
- 新增 test_auth_hub_client.py 锁定 find_or_create_user 按 auth_hub_sub 幂等——生产上曾经因为
  这个函数在没有该测试保护时被测试触发，误建过一个空账号，靠手工核对 health_data 计数才发现。
- 生产 auth-hub 侧另行为该项目注册了正式 client（未随本次提交变更，凭证只存在服务器 .env）。

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/tests/conftest.py

@@ -8,6 +8,7 @@ tests never share state.
 import os
 import sys
 import tempfile
+import uuid
 
 import pytest
 
@@ -24,6 +25,7 @@ os.environ.setdefault(
 
 import db as db_module  # noqa: E402
 from app import create_app  # noqa: E402
+from auth import sign_token  # noqa: E402
 
 # config.py calls load_dotenv() at import, so backend/.env leaks into the test
 # process — a developer's real AI_MODEL_CHAIN or API keys would silently change
@@ -48,10 +50,6 @@ _AI_ENV_VARS = (
 def _isolate_ai_env(monkeypatch):
     for var in _AI_ENV_VARS:
         monkeypatch.delenv(var, raising=False)
-    # Most tests need to create users freely; the production default closes
-    # registration once one account exists. test_registration_policy.py clears
-    # this to exercise the real default.
-    monkeypatch.setenv("ALLOW_REGISTRATION", "true")
 
 
 @pytest.fixture(autouse=True)
@@ -90,21 +88,32 @@ def client(app):
     return app.test_client()
 
 
-@pytest.fixture
-def user(client):
-    """A registered user: returns {id, email, token, password}."""
-    password = "secret123"
-    resp = client.post(
-        "/api/auth/register",
-        json={
-            "email": "tester@example.com",
-            "garminEmail": "gm@example.com",
-            "garminPassword": password,
-        },
+def _insert_user(email):
+    """Create a user row directly, bypassing HTTP.
+
+    Accounts now come from auth-hub's OAuth dance (see routes/auth.py); the
+    test suite has no reason to exercise that network round trip just to get
+    a user id and a valid JWT.
+    """
+    uid = str(uuid.uuid4())
+    token = sign_token(uid)
+    db_module.execute(
+        "INSERT INTO users (id, email, auth_hub_username, jwt_token) VALUES (?, ?, ?, ?)",
+        [uid, email, email, token],
     )
-    assert resp.status_code == 201, resp.get_data(as_text=True)
-    body = resp.get_json()
-    return {**body, "password": password}
+    return {"id": uid, "email": email, "token": token}
+
+
+@pytest.fixture
+def make_user(db):
+    """Factory for creating additional users, e.g. for cross-account isolation tests."""
+    return _insert_user
+
+
+@pytest.fixture
+def user(db):
+    """A user, as if they had signed in through auth-hub: {id, email, token}."""
+    return _insert_user("tester@example.com")
 
 
 @pytest.fixture