Add Komoot import with public (bio verification) and authenticated modes

Two-mode import: public mode verifies Komoot account ownership by checking
that the user's trails.cool profile URL appears in their Komoot bio — no
credentials stored. Authenticated mode uses email + password (AES-256-GCM
encrypted) to import private tours as well.

Includes unit tests for crypto/komoot client and E2E tests for the full
connect + import flow.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/journal/app/lib/connected-services/registry.ts

@@ -96,6 +96,9 @@ export interface ProviderManifest {
   oauthConfig?: ProviderOAuthConfig;
   // OAuth scopes requested at connect time. Wahoo grants all-or-nothing.
   scopes?: string[];
+  // Custom connect page URL. When set, the connections settings page links
+  // here instead of the default OAuth connect endpoint.
+  connectUrl?: string;
   // OAuth authorization URL builder (for the connect flow).
   buildAuthUrl?: (redirectUri: string, state: string) => string;
   // OAuth code exchange (for the callback). Returns the credential blob to