feat(garmin): 增加「退出 Garmin 账号」功能，删除已保存令牌以便重新登录

backend: services/garmin.py 新增 delete_token()，删除 garmin_tokens 行并 forget_client 丢弃缓存会话；routes/garmin.py 新增 POST /api/garmin/disconnect（require_auth），返回 ok + 提示文案。
frontend: api.ts 增加 disconnectGarmin()；SyncPage 增加「退出 Garmin 账号」按钮（带二次确认弹窗）；DataSync.css 增加危险色样式。
设计：仅删除 OAuth 令牌，保留 users.garmin_email，下次重登只需密码；已同步的健康数据不受影响。

backend/services/garmin.py

@@ -257,6 +257,18 @@ def has_token(user_id):
     return load_token(user_id) is not None
 
 
+def delete_token(user_id):
+    """Forget the stored Garmin OAuth token.
+
+    The next sync or login will have to re-authenticate and mint a fresh token.
+    garmin_email on the user record is left in place so re-login only needs the
+    password. The cached client — built from the old token's session — is dropped
+    in the same step so a stale session can't keep being reused.
+    """
+    execute("DELETE FROM garmin_tokens WHERE user_id = ?", [user_id])
+    forget_client(user_id)
+
+
 # An authenticated client, reused across requests in this process.
 #
 # Building one costs ~11s against Garmin — loading the token, refreshing the