Add Wahoo activity sync with provider-agnostic framework

Provider-agnostic sync framework + Wahoo as first implementation:

Framework (apps/journal/app/lib/sync/):
- SyncProvider interface for OAuth2, webhooks, import, conversion
- Provider registry for settings UI iteration
- Generic sync_connections + sync_imports tables
- Token storage with auto-refresh

Wahoo provider:
- OAuth2 with workouts_read, user_read, offline_data scopes
- Webhook-based auto-import (workout_summary events)
- Manual import page with pagination
- FIT→GPX conversion via fit-file-parser
- Webhook token verification

Routes:
- /api/sync/connect/:provider — OAuth redirect
- /api/sync/callback/:provider — OAuth callback
- /api/sync/disconnect/:provider — remove connection
- /api/sync/webhook/:provider — webhook receiver
- /sync/import/:provider — manual import page

Settings: Connected Services section with per-provider connect/disconnect

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

openspec/changes/wahoo-import/specs/account-settings/spec.md

@@ -0,0 +1,10 @@
+## MODIFIED Requirements
+
+### Requirement: Connected Services section
+The settings page SHALL include a "Connected Services" section for managing external integrations.
+
+#### Scenario: Wahoo connection status
+- **WHEN** a user views the settings page
+- **THEN** a "Connected Services" section shows Wahoo as connected or disconnected
+- **AND** connected state shows "Disconnect" button
+- **AND** disconnected state shows "Connect Wahoo" button

openspec/changes/wahoo-import/specs/journal-auth/spec.md

@@ -0,0 +1,9 @@
+## MODIFIED Requirements
+
+### Requirement: Store external service tokens
+The journal auth system SHALL store OAuth tokens for external services alongside user credentials.
+
+#### Scenario: Wahoo token storage
+- **WHEN** a user connects their Wahoo account
+- **THEN** access token, refresh token, expiry time, and Wahoo user ID are stored in the `wahoo_tokens` table
+- **AND** tokens are associated with the journal user ID

openspec/changes/wahoo-import/specs/wahoo-import/spec.md

@@ -0,0 +1,70 @@
+## ADDED Requirements
+
+### Requirement: Provider-agnostic sync framework
+The system SHALL provide a common interface for external activity sync providers.
+
+#### Scenario: Add new provider
+- **WHEN** a developer wants to add a new sync provider (e.g., Garmin)
+- **THEN** they implement the `SyncProvider` interface in a single file
+- **AND** register it in the provider registry
+- **AND** all OAuth, webhook, import, and settings UI works automatically
+
+### Requirement: Connect Wahoo account
+Users SHALL be able to connect their Wahoo account via OAuth2.
+
+#### Scenario: Connect Wahoo
+- **WHEN** a user clicks "Connect Wahoo" in journal settings
+- **THEN** they are redirected to Wahoo's OAuth authorization page with scopes `workouts_read`, `user_read`, `offline_data`
+- **AND** after granting permission, redirected back to the journal
+- **AND** access and refresh tokens are stored in `sync_connections`
+
+#### Scenario: Disconnect Wahoo
+- **WHEN** a user clicks "Disconnect" next to their Wahoo connection
+- **THEN** the stored tokens are deleted from `sync_connections`
+
+#### Scenario: Token refresh
+- **WHEN** a Wahoo API call fails with an expired token
+- **THEN** the refresh token is used to obtain a new access token automatically
+
+### Requirement: Webhook-based automatic sync
+New Wahoo workouts SHALL be automatically imported when they complete.
+
+#### Scenario: Webhook receives new workout
+- **WHEN** Wahoo sends a `workout_summary` webhook to `/api/sync/webhook/wahoo`
+- **THEN** the system identifies the user via `provider_user_id`
+- **AND** downloads the FIT file from Wahoo's CDN
+- **AND** converts it to GPX
+- **AND** creates a journal activity with the GPX, stats, and PostGIS geometry
+- **AND** records the import in `sync_imports` to prevent duplicates
+
+#### Scenario: Duplicate webhook
+- **WHEN** a webhook arrives for a workout already imported
+- **THEN** the import is skipped silently (idempotent)
+
+#### Scenario: Unknown user webhook
+- **WHEN** a webhook arrives with a `provider_user_id` not matching any connection
+- **THEN** the request is ignored with a 200 response (don't reveal user existence)
+
+### Requirement: Manual import
+Users SHALL be able to browse and selectively import older Wahoo workouts.
+
+#### Scenario: View workout list
+- **WHEN** a user visits the Wahoo import page
+- **THEN** their Wahoo workouts are listed with date, type, duration, and distance
+- **AND** already-imported workouts are marked
+
+#### Scenario: Import workout
+- **WHEN** a user clicks "Import" on a Wahoo workout
+- **THEN** the FIT file is downloaded, converted to GPX, and a new activity is created
+
+### Requirement: FIT to GPX conversion
+The system SHALL convert Wahoo's FIT binary files to GPX format.
+
+#### Scenario: Convert FIT with GPS data
+- **WHEN** a FIT file contains GPS track records
+- **THEN** track points with lat, lon, elevation, and timestamp are extracted
+- **AND** a valid GPX string is produced using `generateGpx`
+
+#### Scenario: FIT without GPS data
+- **WHEN** a FIT file has no GPS records (e.g., indoor trainer workout)
+- **THEN** the activity is created without GPX or geometry (stats only)