Multi-user via PocketID: account linking, group gating, admin user management

PocketID OIDC already auto-provisioned users keyed by pocketid_sub, and the
data layer was already fully user-scoped. This adds the missing pieces for
running real multi-user:

- auth.py callback: link by email to an existing un-linked account (so the
  admin keeps their data when first signing in by passkey), collision-safe
  username generation, and request the `groups` scope.
- Group gating: optional pocketid_allowed_group (admin-config or
  POCKETID_ALLOWED_GROUP env); users lacking the group are rejected at the
  callback and redirected to /login?auth_error=not_authorized.
- New admin users API (app/api/users.py): list users, promote/demote admin
  (guards against demoting/locking out the last admin or yourself), and delete
  a user with ordered bulk deletes of all their data + on-disk files.
- ProfilePage: allowed-group field; LoginPage: rejected-login message;
  Layout: admin-only Users nav; new UsersPage.

Resync milevault_export to current source (it had drifted many features behind
— missing garmin_sync, npm-ci Dockerfile and @polyline-codec that broke its own
CI) and add POCKETID_ALLOWED_GROUP to .env.example.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

milevault_export/backend/app/api/upload.py

@@ -75,6 +75,22 @@ async def upload_garmin_export(
                 fit_path = extract_dir / name
                 task = process_activity_file.delay(str(fit_path), current_user.id, "fit")
                 task_ids.append(task.id)
+            elif lower.endswith(".zip"):
+                # Garmin exports nest activity FIT files inside sub-zips
+                # (e.g. DI-Connect-Uploaded-Files/UploadedFiles_*_Part*.zip)
+                nested_zip_path = extract_dir / name
+                nested_extract = nested_zip_path.parent / nested_zip_path.stem
+                nested_extract.mkdir(exist_ok=True)
+                try:
+                    with zipfile.ZipFile(nested_zip_path) as nzf:
+                        nzf.extractall(nested_extract)
+                        for nested_name in nzf.namelist():
+                            if nested_name.lower().endswith(".fit"):
+                                fit_path = nested_extract / nested_name
+                                task = process_activity_file.delay(str(fit_path), current_user.id, "fit")
+                                task_ids.append(task.id)
+                except zipfile.BadZipFile:
+                    pass
 
     # Queue health/wellness data extraction
     health_task = process_garmin_health_zip.delay(str(dest), current_user.id)
@@ -82,7 +98,7 @@ async def upload_garmin_export(
     return {
         "status": "queued",
         "activity_tasks": len(task_ids),
-        "health_task": health_task.id,
+        "task_id": health_task.id,
     }
 
 
@@ -116,6 +132,7 @@ async def upload_strava_export(
     return {
         "status": "queued",
         "activity_tasks": len(task_ids),
+        "task_id": task_ids[-1] if task_ids else None,
     }