feat(auth): 接入 auth-hub 统一登录，网页登录与 Garmin 同步彻底分离

网页身份改由 auth-hub 做 OAuth2 + PKCE 单点登录，本地邮箱/密码登录与注册整条链路删除
（routes/auth.py、auth.py 的密码哈希、config.py 的 ALLOW_REGISTRATION）。Garmin 账号绑定/
同步保持完全独立、可选：routes/garmin.py 不再直接查 users 表，Garmin 邮箱回退统一走新增
的 services/garmin.py::get_remembered_email()（优先读 garmin_tokens 当前绑定，兼容早期账号
落在 users.garmin_email 的历史值），彻底把「你是谁」和「你绑没绑 Garmin」两件事拆开。

- db.py: users 表新增 auth_hub_sub/auth_hub_username，MIGRATIONS 补上这两列（此前遗漏导致
  已存在的生产 MariaDB 表永远不会自动加列）；同时把历史遗留的 garmin_email/
  garmin_password_hash NOT NULL 约束在线迁移为可空，因为新账号不再在注册时收集这些字段。
- routes/auth.py: 修掉 /callback 路由重复拼接 /api/auth 前缀导致 404 的 bug。
- client: LoginPage 去掉本地登录/注册标签页，只保留 auth-hub 统一登录；登录成功/失败后都
  用 history.replaceState 清理地址栏，修掉 Framework7 browserHistory 读取
  /auth/callback?code=... 导致「找不到页面」的问题。
- 新增 test_auth_hub_client.py 锁定 find_or_create_user 按 auth_hub_sub 幂等——生产上曾经因为
  这个函数在没有该测试保护时被测试触发，误建过一个空账号，靠手工核对 health_data 计数才发现。
- 生产 auth-hub 侧另行为该项目注册了正式 client（未随本次提交变更，凭证只存在服务器 .env）。

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/tests/test_auth.py

@@ -1,7 +1,5 @@
-"""Unit tests for password hashing, JWT handling, and the auth endpoints."""
+"""Unit tests for JWT handling and the auth endpoints."""
 import datetime
-import hashlib
-import os
 
 import jwt
 import pytest
@@ -10,66 +8,6 @@ import auth
 from config import JWT_SECRET
 
 
-# --- password hashing -------------------------------------------------------
-class TestPasswordHashing:
-    def test_hash_is_verifiable(self):
-        stored = auth.hash_password("correct horse")
-        assert auth.verify_password("correct horse", stored) is True
-
-    def test_wrong_password_rejected(self):
-        stored = auth.hash_password("correct horse")
-        assert auth.verify_password("wrong horse", stored) is False
-
-    def test_salt_makes_hashes_unique(self):
-        a = auth.hash_password("same")
-        b = auth.hash_password("same")
-        assert a != b, "identical passwords must not produce identical hashes"
-
-    def test_hash_format_is_self_describing(self):
-        stored = auth.hash_password("pw")
-        prefix, iterations, salt, digest = stored.split("$")
-        assert prefix == auth.PBKDF2_PREFIX
-        assert int(iterations) == auth.PBKDF2_ITERATIONS
-        assert len(bytes.fromhex(salt)) == 16
-        assert len(bytes.fromhex(digest)) == 64
-
-    def test_password_never_appears_in_hash(self):
-        stored = auth.hash_password("supersecret")
-        assert "supersecret" not in stored
-
-    @pytest.mark.parametrize(
-        "stored",
-        ["", None, "garbage", "pbkdf2_sha256$notanint$aa$bb", "nothex:nothex"],
-    )
-    def test_malformed_hashes_rejected_not_raised(self, stored):
-        assert auth.verify_password("anything", stored) is False
-
-    def test_hashing_does_not_require_scrypt(self, monkeypatch):
-        """Regression: macOS system Python (LibreSSL) has no hashlib.scrypt.
-
-        Registration used to raise AttributeError -> HTTP 500 on those builds.
-        """
-        monkeypatch.delattr(hashlib, "scrypt", raising=False)
-        stored = auth.hash_password("pw")
-        assert auth.verify_password("pw", stored) is True
-
-    def test_unicode_password(self):
-        stored = auth.hash_password("密码🔒")
-        assert auth.verify_password("密码🔒", stored) is True
-        assert auth.verify_password("密码", stored) is False
-
-    @pytest.mark.skipif(
-        not hasattr(hashlib, "scrypt"), reason="interpreter built without scrypt"
-    )
-    def test_legacy_scrypt_hash_still_verifies(self):
-        salt = os.urandom(16)
-        digest = hashlib.scrypt(
-            b"legacy", salt=salt, n=16384, r=8, p=1, dklen=64
-        ).hex()
-        assert auth.verify_password("legacy", f"{salt.hex()}:{digest}") is True
-        assert auth.verify_password("nope", f"{salt.hex()}:{digest}") is False
-
-
 # --- JWT --------------------------------------------------------------------
 class TestTokens:
     def test_sign_and_verify_roundtrip(self):
@@ -96,93 +34,6 @@ class TestTokens:
             auth.verify_token(f"{head}.{payload}.{sig[:-2]}xx")
 
 
-# --- register ---------------------------------------------------------------
-class TestRegister:
-    def test_returns_201_and_token(self, client):
-        r = client.post(
-            "/api/auth/register",
-            json={
-                "email": "a@example.com",
-                "garminEmail": "g@example.com",
-                "garminPassword": "pw123456",
-            },
-        )
-        assert r.status_code == 201
-        body = r.get_json()
-        assert body["email"] == "a@example.com"
-        assert auth.verify_token(body["token"])["user_id"] == body["id"]
-
-    def test_duplicate_email_conflicts(self, client, user):
-        r = client.post(
-            "/api/auth/register",
-            json={
-                "email": user["email"],
-                "garminEmail": "other@example.com",
-                "garminPassword": "pw123456",
-            },
-        )
-        assert r.status_code == 409
-
-    @pytest.mark.parametrize(
-        "payload",
-        [
-            {},
-            {"email": "a@example.com"},
-            {"email": "a@example.com", "garminEmail": "g@example.com"},
-            {"email": "", "garminEmail": "g@example.com", "garminPassword": "x"},
-        ],
-    )
-    def test_missing_fields_rejected(self, client, payload):
-        assert client.post("/api/auth/register", json=payload).status_code == 400
-
-    def test_password_stored_only_as_hash(self, client, db):
-        client.post(
-            "/api/auth/register",
-            json={
-                "email": "h@example.com",
-                "garminEmail": "g@example.com",
-                "garminPassword": "plaintext-secret",
-            },
-        )
-        row = db.query_one(
-            "SELECT garmin_password_hash FROM users WHERE email = ?", ["h@example.com"]
-        )
-        assert "plaintext-secret" not in row["garmin_password_hash"]
-        assert auth.verify_password("plaintext-secret", row["garmin_password_hash"])
-
-
-# --- login ------------------------------------------------------------------
-class TestLogin:
-    def test_valid_credentials(self, client, user):
-        r = client.post(
-            "/api/auth/login",
-            json={"email": user["email"], "password": user["password"]},
-        )
-        assert r.status_code == 200
-        assert r.get_json()["id"] == user["id"]
-
-    def test_wrong_password(self, client, user):
-        r = client.post(
-            "/api/auth/login", json={"email": user["email"], "password": "nope"}
-        )
-        assert r.status_code == 401
-
-    def test_unknown_email(self, client):
-        r = client.post(
-            "/api/auth/login", json={"email": "ghost@example.com", "password": "pw"}
-        )
-        assert r.status_code == 401
-
-    def test_error_does_not_reveal_which_field_was_wrong(self, client, user):
-        unknown = client.post(
-            "/api/auth/login", json={"email": "ghost@example.com", "password": "pw"}
-        ).get_json()
-        bad_pw = client.post(
-            "/api/auth/login", json={"email": user["email"], "password": "nope"}
-        ).get_json()
-        assert unknown == bad_pw, "responses must not distinguish the two cases"
-
-
 # --- require_auth -----------------------------------------------------------
 class TestRequireAuth:
     def test_missing_header(self, client):