Strava integration + shareable stat cards - #100

Closes #86.

Strava integration

• Opt-in in Settings → Strava: master toggle runs OAuth (ASWebAuthenticationSession, activity:write scope enforced) and only latches on success; Manual / Automatic upload-mode picker.
• Automatic: new workouts upload as they finish (watermark + automaticSince stamped at enable — no backfill of older activities). StravaSyncPublisher mirrors the Apple Health sync hook (15 s debounce on PulseDataChange).
• Manual: "Push to Strava" row on activity detail + post-workout summary, with uploading / "On Strava" (deep-links to the activity) / error-retry states.
• Uploads as TCX: GPS route merged with ring HR by timestamp (60 s staleness window), pause intervals excised; indoor workouts upload HR-only trackpoints; sessions with no HR/GPS fall back to manual activity creation. Sport corrected via PUT /activities when TCX's Running/Biking/Other can't express it.
• De-dup via new additive ActivitySession.stravaActivityId; "duplicate of activity N" upload errors resolve to the existing id.
• Tokens in Keychain (single JSON blob) with single-flight auto-refresh; rotated tokens persisted before use; disconnect deauthorizes + wipes tokens; factory reset cleans up.
• Credentials load from a gitignored PulseLoop/Integrations/Strava/StravaSecrets.plist (StravaClientID / StravaClientSecret); without it the settings screen shows a not-configured state. Strava app callback domain: localhost.

Shareable stat cards (#86)

• Share button on activity detail toolbar + post-workout summary → preview sheet with Story 9:16 / Square 1:1 toggle → native share sheet (ShareLink, PNG at exactly 1080×1920 / 1080×1080 via ImageRenderer).
• Route rendered as glowing line art from ActivityGpsPoint (deterministic, offline, on-brand — no map tiles); indoor workouts get the activity glyph inside concentric pulse rings.
• Per-activity accent + glyph, type-appropriate stats, HR-zone effort bar, PulseLoop wordmark attribution on every card.
• Debug hooks: -demoStravaConnected YES (fake connected state, no network) and -shareCardDump YES (writes both PNGs to Documents).

Testing

• 819 tests pass, ~1,500 lines of new coverage: TCX generation (HR merge, pauses, UTC), OAuth refresh/single-flight/401 handling, upload dedup + contiguous watermark + automaticSince guard, multipart encoding, duplicate parsing, route projection math, renderer pixel sizes.
• Simulator smoke-tested: settings states, mode picker, upload row, both card formats (GPS + indoor), pixel-exact dumps.
• Not covered: live OAuth + real upload (needs device + real credentials).