fix: cleanup StravaConfig on user delete (FK violation); equalize login timing (user enum); scope upload task-status to owner; SQL-side data-point downsampling; drop unused clsx/react-leaflet deps

backend/app/api/auth.py

@@ -9,7 +9,7 @@ from jose import jwt, JWTError
 import httpx
 
 from app.core.database import get_db
-from app.core.security import verify_password, create_access_token, get_current_user
+from app.core.security import verify_password, dummy_verify_password, create_access_token, get_current_user
 from app.core.config import settings
 from app.models.user import User
 
@@ -141,6 +141,9 @@ async def login(
     result = await db.execute(select(User).where(User.username == form_data.username))
     user = result.scalar_one_or_none()
     if not user:
+        # Spend the same time as a real verify so timing can't reveal whether
+        # the username exists.
+        dummy_verify_password()
         raise HTTPException(status_code=400, detail="Invalid credentials")
     if user.pocketid_sub is not None:
         raise HTTPException(