Refactor: split serve/server.py (3220 lines) into focused modules

serve/server.py is now 69 lines — app factory, middleware, and router
registration only.

New modules:
  deps.py    (168 lines) — module-level globals + auth dependency functions
  models.py   (85 lines) — all Pydantic request/response models
  tasks.py   (136 lines) — background workers and job tracker
  routers/               — one file per domain (10 routers, ~2750 lines total)
    auth.py, me.py, admin.py, activities.py, uploads.py,
    segments.py, strava.py, garmin.py, ideas.py, feed.py

cli.py updated to set globals on deps instead of server.

88 new regression tests in tests/serve/ cover auth guards and key
behaviours for every router; 294 total passing after the split.

tests/serve/test_garmin_router.py

@@ -0,0 +1,24 @@
+"""Pre-split regression tests for /api/garmin/* routes."""
+from __future__ import annotations
+
+from fastapi.testclient import TestClient
+
+
+class TestGarminRoutes:
+    def test_status_unauthenticated_returns_401(self, client: TestClient):
+        assert client.get("/api/garmin/status").status_code == 401
+
+    def test_connect_unauthenticated_returns_401(self, client: TestClient):
+        assert client.post("/api/garmin/connect", json={}).status_code == 401
+
+    def test_disconnect_unauthenticated_returns_401(self, client: TestClient):
+        assert client.post("/api/garmin/disconnect").status_code == 401
+
+    def test_status_authenticated_returns_connected(self, user_client: TestClient):
+        r = user_client.get("/api/garmin/status")
+        assert r.status_code == 200
+        assert "connected" in r.json()
+
+    def test_connect_missing_fields_returns_400(self, user_client: TestClient):
+        r = user_client.post("/api/garmin/connect", json={})
+        assert r.status_code == 400