Multi-user via PocketID: account linking, group gating, admin user management

PocketID OIDC already auto-provisioned users keyed by pocketid_sub, and the
data layer was already fully user-scoped. This adds the missing pieces for
running real multi-user:

- auth.py callback: link by email to an existing un-linked account (so the
  admin keeps their data when first signing in by passkey), collision-safe
  username generation, and request the `groups` scope.
- Group gating: optional pocketid_allowed_group (admin-config or
  POCKETID_ALLOWED_GROUP env); users lacking the group are rejected at the
  callback and redirected to /login?auth_error=not_authorized.
- New admin users API (app/api/users.py): list users, promote/demote admin
  (guards against demoting/locking out the last admin or yourself), and delete
  a user with ordered bulk deletes of all their data + on-disk files.
- ProfilePage: allowed-group field; LoginPage: rejected-login message;
  Layout: admin-only Users nav; new UsersPage.

Resync milevault_export to current source (it had drifted many features behind
— missing garmin_sync, npm-ci Dockerfile and @polyline-codec that broke its own
CI) and add POCKETID_ALLOWED_GROUP to .env.example.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

milevault_export/backend/app/api/profile.py

@@ -19,6 +19,7 @@ class ProfileUpdate(BaseModel):
     resting_heart_rate: Optional[int] = None
     birth_year: Optional[int] = None
     height_cm: Optional[float] = None
+    biological_sex: Optional[str] = None
 
 
 class ProfileOut(BaseModel):
@@ -29,6 +30,7 @@ class ProfileOut(BaseModel):
     resting_heart_rate: Optional[int]
     birth_year: Optional[int]
     height_cm: Optional[float]
+    biological_sex: Optional[str]
     estimated_max_hr: Optional[int]
     is_admin: bool
 
@@ -55,6 +57,7 @@ async def update_profile(
     db: AsyncSession = Depends(get_db),
     current_user: User = Depends(get_current_user),
 ):
+    old_max_hr = current_user.max_heart_rate
     if body.max_heart_rate is not None:
         if not (100 <= body.max_heart_rate <= 250):
             raise HTTPException(400, "Max HR must be 100–250")
@@ -71,9 +74,18 @@ async def update_profile(
         if not (50 <= body.height_cm <= 300):
             raise HTTPException(400, "Height must be 50–300 cm")
         current_user.height_cm = body.height_cm
+    if body.biological_sex is not None:
+        if body.biological_sex not in ('male', 'female', ''):
+            raise HTTPException(400, "biological_sex must be 'male' or 'female'")
+        current_user.biological_sex = body.biological_sex or None
 
     await db.commit()
     await db.refresh(current_user)
+
+    if body.max_heart_rate is not None and body.max_heart_rate != old_max_hr:
+        from app.workers.tasks import recalculate_hr_zones_for_user
+        recalculate_hr_zones_for_user.delay(current_user.id, body.max_heart_rate)
+
     return {**{c.name: getattr(current_user, c.name)
                for c in User.__table__.columns},
             "estimated_max_hr": _estimated_max_hr(current_user)}
@@ -109,6 +121,7 @@ class PocketIDConfig(BaseModel):
     issuer: Optional[str] = None
     client_id: Optional[str] = None
     client_secret: Optional[str] = None
+    allowed_group: Optional[str] = None
 
 
 @router.get("/pocketid-config")
@@ -119,10 +132,12 @@ async def get_pocketid_config(current_user: User = Depends(get_current_user)):
     # Show DB config if set, fall back to env
     issuer = current_user.pocketid_issuer or settings.pocketid_issuer
     client_id = current_user.pocketid_client_id or settings.pocketid_client_id
+    allowed_group = current_user.pocketid_allowed_group or settings.pocketid_allowed_group
     return {
         "issuer": issuer or "",
         "client_id": client_id or "",
         "client_secret_set": bool(current_user.pocketid_client_secret or settings.pocketid_client_secret),
+        "allowed_group": allowed_group or "",
         "enabled": bool(issuer and client_id),
     }
 
@@ -141,6 +156,8 @@ async def save_pocketid_config(
         current_user.pocketid_client_id = body.client_id or None
     if body.client_secret is not None:
         current_user.pocketid_client_secret = body.client_secret or None
+    if body.allowed_group is not None:
+        current_user.pocketid_allowed_group = body.allowed_group.strip() or None
     await db.commit()
     return {"status": "ok"}