fix(garmin): 两步验证账号同步报 EOFError，改用令牌登录

现象：网页触发同步报 "EOF when reading a line"。

原因：garth 的默认 MFA 提示是 input()，向 stdin 索取验证码。
gunicorn worker 没有 stdin，于是抛出 EOFError——错误信息本身
完全没提到 MFA，看不出该做什么。

方案：把"输验证码"和"日常同步"拆开。
- 新增 garmin_tokens 表存 garth 令牌（Client.dumps/loads 序列化）
- garmin_login.py：在终端里跑一次，可正常输入验证码，
  成功后令牌存库
- _connect() 优先加载令牌并 refresh_oauth2()，命中则完全跳过登录，
  既不需要密码也不需要验证码（令牌有效期约一年）
- 无令牌且密码登录撞上 MFA 时，抛 MFARequired 并给出具体该执行
  哪条命令，而不是把 EOFError 原样抛给用户

接口:
- GET /api/garmin/auth-status 返回是否已有令牌
- /api/garmin/sync 在已有令牌时不再强制要求密码

前端:
- 有令牌时隐藏密码输入框，提示无需密码
- 同步返回 mfaRequired 时，展示需要在 NAS 上执行的具体命令
- 同步请求超时放宽到 180s（一周的天数 + 运动是多次上游调用）
- 成功消息补上运动记录条数

tests (test_garmin_sync.py 新增 12 条，共 35):
- 令牌存取、覆盖不累积、按用户隔离
- 有令牌时绝不调用 login()
- MFA 的 EOFError 转成带操作指引的 MFARequired
- 普通 401 不会被误标成 mfaRequired
- 无令牌且无密码时给出明确拒绝

NAS 真机: 252 passed

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

backend/services/garmin.py

@@ -65,20 +65,84 @@ def get_sync_status(user_id):
     }
 
 
-def _connect(creds):
-    """Log in to Garmin Connect. Separated so tests can substitute a client."""
+class MFARequired(RuntimeError):
+    """Raised when a password login needs a code this process cannot obtain."""
+
+
+def _is_cn():
+    # Selects Garmin's China service, a separate backend with separate
+    # accounts. This project tracks an international account.
+    return (os.environ.get("GARMIN_IS_CN") or "").lower() in ("1", "true", "yes")
+
+
+def _import_garmin():
     try:
         from garminconnect import Garmin
     except ImportError:
         raise RuntimeError(
             "GARMIN_LIB_MISSING: 请先运行 `pip install garminconnect` 以启用同步"
         )
+    return Garmin
 
-    # is_cn selects Garmin's China service, which is a different backend with
-    # separate accounts. This project tracks an international account.
-    is_cn = (os.environ.get("GARMIN_IS_CN") or "").lower() in ("1", "true", "yes")
-    client = Garmin(email=creds["garminEmail"], password=creds["garminPassword"], is_cn=is_cn)
-    client.login()
+
+def load_token(user_id):
+    row = query_one("SELECT token FROM garmin_tokens WHERE user_id = ?", [user_id])
+    return row["token"] if row else None
+
+
+def save_token(user_id, token, garmin_email=None):
+    cols = ["user_id", "token", "garmin_email", "updated_at"]
+    placeholders = ", ".join(["?"] * len(cols))
+    if DB_TYPE == "mariadb":
+        updates = ", ".join(f"{c}=VALUES({c})" for c in cols if c != "user_id")
+        sql = (f"INSERT INTO garmin_tokens ({', '.join(cols)}) VALUES ({placeholders}) "
+               f"ON DUPLICATE KEY UPDATE {updates}")
+    else:
+        updates = ", ".join(f"{c}=excluded.{c}" for c in cols if c != "user_id")
+        sql = (f"INSERT INTO garmin_tokens ({', '.join(cols)}) VALUES ({placeholders}) "
+               f"ON CONFLICT(user_id) DO UPDATE SET {updates}")
+    execute(sql, [user_id, token, garmin_email,
+                  datetime.datetime.utcnow().isoformat(timespec="seconds")])
+
+
+def has_token(user_id):
+    return load_token(user_id) is not None
+
+
+def _connect(creds, user_id=None):
+    """Obtain a logged-in Garmin client.
+
+    Prefers stored OAuth tokens: an account with two-factor auth cannot be
+    logged into from a web worker, because the library asks for the code on
+    stdin and there is none (the failure surfaces as
+    "EOFError: EOF when reading a line"). Tokens are minted once by
+    `garmin_login.py`, which runs in a terminal where a code can be typed.
+    """
+    Garmin = _import_garmin()
+    client = Garmin(is_cn=_is_cn())
+
+    token = load_token(user_id) if user_id else None
+    if token:
+        client.garth.loads(token)
+        # Populates display_name/unit_system and proves the token still works.
+        client.garth.refresh_oauth2()
+        client.display_name = client.garth.profile["displayName"]
+        return client
+
+    if not creds.get("garminPassword"):
+        raise RuntimeError("缺少 Garmin 密码，且未找到已保存的登录令牌")
+
+    client.username = creds["garminEmail"]
+    client.password = creds["garminPassword"]
+    try:
+        client.login()
+    except EOFError as e:
+        # garth's default MFA prompt calls input(); under gunicorn stdin is
+        # closed, so it raises EOFError rather than anything descriptive.
+        raise MFARequired(
+            "该 Garmin 账号开启了两步验证，无法在服务端直接登录。"
+            "请在 NAS 上执行一次 `python garmin_login.py` 完成验证并保存令牌。"
+        ) from e
     return client
 
 
@@ -194,12 +258,17 @@ def sync_data(user_id, creds, days=None, client=None):
     _set_sync_status(user_id, "syncing", now, records_synced=0)
 
     try:
-        client = client or _connect(creds)
+        client = client or _connect(creds, user_id)
     except Exception as e:
         message = str(e)
         _set_sync_status(user_id, "error", now, records_synced=0, last_error=message)
-        return {"status": "error", "recordsSynced": 0, "message": message,
-                "lastSyncTime": now}
+        return {
+            "status": "error",
+            "recordsSynced": 0,
+            "message": message,
+            "mfaRequired": isinstance(e, MFARequired),
+            "lastSyncTime": now,
+        }
 
     today = datetime.date.today()
     start_date = (today - datetime.timedelta(days=days - 1)).isoformat()