Add Wahoo pushRoute and SyncProvider push interface

Extends the SyncProvider interface with an optional pushRoute method
plus PushRoutePayload, PushRouteResult, and a typed PushError so the
slice-4 action route can map error codes to user-facing copy without
parsing HTTP statuses itself.

Wahoo provider:
- adds routes_write to the requested OAuth scope set
- implements pushRoute: base64-encodes the FIT, builds the form body
  Wahoo's POST /v1/routes expects, parses the remote id out of the
  response, and throws typed PushError on 401/403/422/429/5xx
- saveConnection now persists the requested scopes as grantedScopes
  on exchangeCode (Wahoo doesn't return a scope field, so the
  requested set is the granted set)

Token refresh on 401 is deferred to the slice-4 action route — same
pattern as the existing webhook handler in this repo, which does
inline refresh rather than wrapping every call.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

apps/journal/app/routes/api.sync.callback.$provider.ts

@@ -20,7 +20,9 @@ export async function loader({ params, request }: Route.LoaderArgs) {
 
   try {
     const tokens = await provider.exchangeCode(code, redirectUri);
-    await saveConnection(user.id, provider.id, tokens);
+    // Wahoo's token endpoint doesn't return a `scope` field and grants
+    // scopes all-or-nothing, so the requested set is the granted set.
+    await saveConnection(user.id, provider.id, tokens, provider.scopes);
   } catch (e) {
     console.error(`OAuth callback failed for ${params.provider}:`, e);
     return redirect("/settings?error=sync_failed");