Add headless Garmin background sync (systemd timer)

New `bincio sync-garmin` command mirrors sync-strava: discovers all users
with garmin_creds.json, refreshes cached garth OAuth2 session, imports new
activities, and optionally POSTs to the rebuild endpoint.

systemd timer fires every 3h offset by 1h30m from Strava to avoid
simultaneous rebuilds. Status written to _garmin_sync_status.json per user.

deploy/systemd/bincio-sync-garmin.service

@@ -0,0 +1,25 @@
+[Unit]
+Description=BincioActivity Garmin sync
+Documentation=https://github.com/bincio/bincio-activity
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+User=root
+WorkingDirectory=/opt/bincio
+
+# Secrets: BINCIO_SYNC_SECRET (must match --sync-secret passed to bincio serve)
+# Copy /opt/bincio/deploy/systemd/sync.env.example → /etc/bincio/sync.env and fill it in.
+EnvironmentFile=/etc/bincio/sync.env
+
+ExecStart=/root/.local/bin/uv run --project /opt/bincio bincio sync-garmin \
+    --data-dir /var/bincio/data \
+    --rebuild-url http://localhost:4041/api/internal/rebuild
+
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=bincio-sync-garmin
+
+# Don't restart on failure — the timer will retry in 3 hours.
+Restart=no

deploy/systemd/bincio-sync-garmin.timer

@@ -0,0 +1,15 @@
+[Unit]
+Description=BincioActivity Garmin sync — every 3 hours
+Documentation=https://github.com/bincio/bincio-activity
+
+[Timer]
+# Fire at 01:30, 04:30, 07:30, 10:30, 13:30, 16:30, 19:30, 22:30 UTC
+# Offset by 1h30m from the Strava timer to avoid simultaneous rebuilds.
+OnCalendar=*-*-* 01,04,07,10,13,16,19,22:30:00
+# Catch up if the VPS was offline during a scheduled run
+Persistent=true
+# Spread load within a 2-minute window
+RandomizedDelaySec=120
+
+[Install]
+WantedBy=timers.target