fix: cleanup StravaConfig on user delete (FK violation); equalize login timing (user enum); scope upload task-status to owner; SQL-side data-point downsampling; drop unused clsx/react-leaflet deps

backend/app/api/users.py

@@ -19,7 +19,8 @@ from app.core.security import get_current_user
 from app.core.config import settings
 from app.models.user import (
     User, Activity, ActivityDataPoint, ActivityLap, NamedRoute,
-    Segment, SegmentEffort, PersonalRecord, HealthMetric, WeightLog, GarminConnectConfig,
+    Segment, SegmentEffort, PersonalRecord, HealthMetric, WeightLog,
+    GarminConnectConfig, StravaConfig,
 )
 
 router = APIRouter()
@@ -134,6 +135,11 @@ async def delete_user(
     await db.execute(delete(HealthMetric).where(HealthMetric.user_id == user_id))
     await db.execute(delete(WeightLog).where(WeightLog.user_id == user_id))
     await db.execute(delete(GarminConnectConfig).where(GarminConnectConfig.user_id == user_id))
+    # StravaConfig holds Fernet-encrypted OAuth tokens and has a NOT-NULL FK to
+    # users with no DB-level cascade; the Core deletes above bypass the ORM
+    # relationship cascade, so it must be removed explicitly or the final
+    # DELETE on users raises a ForeignKey violation (and leaves tokens orphaned).
+    await db.execute(delete(StravaConfig).where(StravaConfig.user_id == user_id))
     await db.execute(delete(User).where(User.id == user_id))
     await db.commit()