sync strava data from web ui

CHANGELOG.md

@@ -1,5 +1,42 @@
 # Changelog
 
+## [Unreleased] — 2026-04-06
+
+### New feature — Strava sync from UI
+
+- **`bincio/extract/strava_api.py`** (new) — Strava OAuth + activity API integration:
+  OAuth URL generation, authorization code exchange, token refresh, paged activity list
+  fetching, stream fetching (time, latlng, altitude, HR, cadence, power, velocity), and
+  conversion of the API response directly to `ParsedActivity` (no file download needed).
+  Token stored in `<data-dir>/strava_token.json`; `last_sync_at` tracks incremental syncs.
+
+- **`bincio/edit/server.py`** — three new endpoints:
+  - `GET /api/strava/status` — returns `{configured, connected, last_sync}` for the UI
+  - `GET /api/strava/auth-url` — returns the OAuth URL for the popup window
+  - `GET /api/strava/callback` — exchanges auth code, saves token, redirects to site with `?strava=connected`
+  - `POST /api/strava/sync` — fetches activities since `last_sync_at`, runs extract pipeline,
+    updates `index.json`, runs `merge_all()`, and updates `last_sync_at` in the token file
+
+- **`bincio/edit/cli.py`** — `--strava-client-id` and `--strava-client-secret` flags added
+  (also read from `STRAVA_CLIENT_ID` / `STRAVA_CLIENT_SECRET` env vars). Strava sync is
+  disabled (endpoints return 400) when credentials are not provided.
+
+- **`site/src/layouts/Base.astro`** — upload modal redesigned with a "choose source" screen:
+  two buttons — "Upload file" (existing drag-and-drop) and "Sync from Strava". Strava button
+  shows "Not configured" when the server lacks credentials, or opens an OAuth popup window.
+  After connecting, a "Sync now" button triggers the sync and reloads the feed on import.
+
+**Setup:** register `http://localhost:4041/api/strava/callback` as an allowed redirect URI
+in your Strava app settings, then run:
+```
+bincio edit --strava-client-id YOUR_ID --strava-client-secret YOUR_SECRET
+# or via env vars: STRAVA_CLIENT_ID=... STRAVA_CLIENT_SECRET=... bincio edit
+```
+
+**Note on the upload button:** the button is visible whenever `PUBLIC_EDIT_URL` is set in
+`site/.env`, regardless of whether the edit server is running. This is intentional — the env
+var is the "edit mode enabled" flag. Remove it from `.env` to hide the button.
+
 ## [Unreleased] — 2026-04-01
 
 ### Security fixes (second-pass audit)