fix: cleanup StravaConfig on user delete (FK violation); equalize login timing (user enum); scope upload task-status to owner; SQL-side data-point downsampling; drop unused clsx/react-leaflet deps

backend/app/core/security.py

@@ -18,6 +18,13 @@ def verify_password(plain: str, hashed: str) -> bool:
     return pwd_context.verify(plain, hashed)
 
 
+def dummy_verify_password() -> None:
+    """Run a throwaway bcrypt verification so the username-not-found login path
+    takes the same time as a real password check, preventing username
+    enumeration via response-timing differences."""
+    pwd_context.dummy_verify()
+
+
 def hash_password(password: str) -> str:
     return pwd_context.hash(password)