Add trend-range gating, vehicle filter, sync cancel, moving time, and UI fixes

- Grey out trend ranges beyond available health history
- Reject implausibly fast (vehicle) activities on upload with feedback
- Add cancel button + cooperative cancellation for Garmin sync
- Show daily steps prominently on the dashboard
- Clear errors for malformed/empty upload ZIPs
- Snap-target dot when drawing a segment on the map
- Time-axis fallback for stationary/HIIT HR timelines; hide map when no GPS
- Parse and display moving time (timer) vs elapsed; backfill task
- Restyle SegmentsPanel like RouteLeaderboard; Laps/Routes/Segments on one row

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CLAUDE.md

@@ -31,6 +31,21 @@ The app is served on port 80 by nginx, which proxies `/api/*` to the backend (po
 
 There are no automated tests. Verification is done by running the app and observing behaviour.
 
+## Debugging running containers
+
+The production stack runs in `~/milevault_docker` with fixed container names. Use these to investigate issues — never patch the running files:
+
+```bash
+# Tail logs from a specific container
+docker logs -f milevault_backend
+docker logs -f milevault_worker
+docker logs -f milevault_db
+
+# Run a one-off query or command inside a container
+docker exec milevault_backend python -c "from app.core.config import settings; print(settings.base_url)"
+docker exec -it milevault_db psql -U milevault -d milevault
+```
+
 ## Building and deploying
 
 `docker-compose.yml` — build from source (dev/CI).  
@@ -40,6 +55,10 @@ The Gitea Actions workflow (`.gitea/workflows/build.yml`) auto-builds and pushes
 
 `./deploy.sh "<commit message>"` is the normal dev loop here: it commits everything, pushes to `main` (triggering the image build), and stops the running stack in `../milevault_docker`. After the build finishes, run `docker compose pull && docker compose up -d` there. This matches the repo rule: fix files in `~/milevault`, push to git — never patch the running containers in `~/milevault_docker`.
 
+**CI validation**: The build workflow runs a `validate` job before building images. It will fail if `@polyline-codec` appears in `frontend/package.json` or if `npm ci` is used in `frontend/Dockerfile` (no lockfile exists — always use `npm install`). Fix these before pushing.
+
+**`VITE_MAPBOX_TOKEN`** is baked empty by the CI build (`build-args: VITE_MAPBOX_TOKEN=`), so satellite tiles are disabled in all pre-built images. To enable them, rebuild locally with the token set in `.env`.
+
 ```bash
 # Rebuild and restart from source:
 docker compose build --no-cache
@@ -94,8 +113,8 @@ docker compose -f docker-compose.deploy.yml up -d
 - TanStack Query (`@tanstack/react-query`) handles all server-state fetching and caching; Zustand is used only for auth state
 - `utils/format.js` — shared formatting helpers: `formatDuration`, `formatPace`, `formatDistance`, `formatCadence`, `hrZoneColor`, `sportIcon`, `sportColor`, etc.
 - `pages/` — one file per route: `Dashboard`, `Activities`, `ActivityDetail`, `Routes`, `Records`, `Health`, `Upload`, `Profile`, `Users`, `Login`
-- `components/activity/` — `ActivityMap` (Leaflet), `MetricTimeline` (Recharts), `HRZoneBar`, `LapTable`, `SegmentsPanel` (per-activity segment efforts)
-- `components/ui/RouteMiniMap` — small Leaflet map used in route/segment cards
+- `components/activity/` — `ActivityMap` (Leaflet), `MetricTimeline` (Recharts), `HRZoneBar`, `LapTable`, `SegmentsPanel` (per-activity segment efforts), `RouteLeaderboard` (top-10 by pace for a named route)
+- `components/ui/` — `Layout` (nav shell), `StatCard`, `RouteMiniMap` (small Leaflet map used in route/segment cards)
 
 The Vite dev server proxies `/api` to `http://backend:8000` (for use inside the Docker Compose network). The production build bakes `VITE_API_URL` at build time.
 
@@ -115,8 +134,11 @@ Required in `.env` (or passed to Docker Compose):
 | `HTTP_PORT` | Host port for nginx (default: `80`) |
 | `FILE_STORE_PATH` | Where uploaded FIT files are stored (default: `/data/files`) |
 | `BASE_URL` | Used for PocketID OAuth callback redirect URI |
-| `VITE_MAPBOX_TOKEN` | Optional — enables satellite tile layer |
+| `ENVIRONMENT` | `production` (default) or `development`; controls CORS (dev allows all origins) |
+| `VITE_MAPBOX_TOKEN` | Optional — enables satellite tile layer (baked at build time) |
+| `GARMIN_SYNC_INTERVAL_MINUTES` | How often the beat scheduler polls Garmin Connect (default: `30`) |
 | `POCKETID_ISSUER` / `POCKETID_CLIENT_ID` / `POCKETID_CLIENT_SECRET` | Optional OIDC |
+| `POCKETID_ALLOWED_GROUP` | Optional — restrict passkey login to a specific PocketID group |
 
 ## milevault_export/